chore(deps): bump @sasjs/lint to 2.5.0 + dependency refresh

[sasjs-dev]

Summary

Bumps @sasjs/lint 2.4.3 → 2.5.0 and @sasjs/core 4.68.1 → 5.2.4, plus updates all other dependencies to the latest compatible versions.

Runtime dependencies

Package	From	To
@sasjs/lint	2.4.3	2.5.0
@sasjs/core	4.68.1	5.2.4
dotenv	16.0.3	17.4.2
js-base64	3.7.5	3.9.3
jsdom	23.2.0	26.0.0
prompts	2.4.1	2.4.2

Follow-up patch bumps: 5.2.3 (mv_getjoblog error surfacing, mv_jobflow paramstring casing) and 5.2.4 (mp_abort _METAPERSON guard, mv_jobwaitfor uri truncation fix) — no CLI-facing changes; none of the affected macros are referenced by the CLI.

@sasjs/core v5 breaking changes are SAS-macro-level (mp_getddl → mp_ds2ddl, mp_testservice → mp_execute, mp_coretable removed, mcf_xxx insert_cmplib removed, mf_getuniquelibref maxtries removed, mp_abort type= removed). Verified the CLI source, mocks and test fixtures reference none of the affected macros — safe major bump for the CLI.

Held back (ESM-only, the CLI is CommonJS — a major bump breaks require): chalk 4.1.2, ora 5.4.1, yargs 17.6.2.
Held back (Node engine): jsdom 27+/30 need Node ≥ 22.22/24.

Dev dependencies

Package	From	To
jest, jest-cli, jest-environment-jsdom, babel-jest	29.4.3	30.5.1
@types/jest	29.4.0	30.0.0
jest-extended	3.2.4	4.0.2
ts-jest	29.0.5	29.4.12
typescript	4.9.5	5.9.3
@types/node	18.14.1	22.10.2
prettier	2.6.2	3.9.6
@babel/core, preset-env, preset-typescript	7.2x	7.29.7
ts-node, tslib, nodemon, util, @types/*		minor bumps

Code changes required by the bumps

• toThrowError → toThrow (jest 30 removed the alias — 4 spec files, 6 call sites)
• toBeCalledTimes → toHaveBeenCalledTimes (jest 30 removed the alias — 1 spec file)
• process.exit mock signatures widened to code?: string | number | null | undefined (new @types/node signature — 2 files)
• 20 files reformatted by prettier 3 (nested-ternary indentation style; no semantic changes)

CI fixes included

• run-tests.yml: wait for sasjs/server readiness (/SASjsApi/info poll, up to 5 min) before "Deploy SAS9 tests" — the deploy was hitting localhost:5000 0.9s after pm2 start, before the server was listening (startup race, unrelated to the bumps)

Verification (all run locally against this branch)

• ✅ 84/84 test suites, 637/637 tests pass (jest --config=jest.config.js --bail=0)
• ✅ npm audit --omit=dev --audit-level=low: 0 vulnerabilities
• ✅ npm audit --audit-level=low (full tree incl. dev): 0 vulnerabilities
• ✅ npm run build: 0 TypeScript errors
• ✅ prettier --check: clean
• ✅ npm run doc: documentation coverage 17% > 16% threshold
• ✅ npm pack + global install + sasjs v works

[github-actions]

Coverage report

Total coverage

Status	Category	Percentage	Covered / Total
🟡	Statements	75.3%	3472/4611
🟡	Branches	62.86%	1415/2251
🟡	Functions	75.03%	700/933
🟢	Lines	83.85%	8855/10560

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Show files with reduced coverage 🔻

Reduced coverage

Status	Filename	Statements	Branches	Functions	Lines
🟢	src/commands/compile/compileSingleFile.ts	95.83% (-2.08% 🔻)	84% (-4% 🔻)	100%	100%

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Report generated by 🧪jest coverage report action from 1ea349e

[4gl-reviewer]

Reviewed the full diff: dependency refresh (package.json, package-lock.json), Prettier reformatting across ~20 source files (ternary indentation, line wrapping), Jest 30 API migrations (toThrowError to toThrow, toBeCalledTimes to toHaveBeenCalledTimes), Node.js process.exit type updates (code?: number to code?: string | number | null | undefined), and a CI reliability improvement (wait-for-server step in .github/workflows/run-tests.yml).

Hardening checklist:

• ignore-scripts=true in committed .npmrc: pass (also has save-exact=true)
• Dependencies pinned to exact versions: pass
• npm audit --audit-level=low in CI: pass
• npm ci in CI: pass
• Lockfile committed and updated: pass
• No secrets in diff: pass
• .gitignore covers .env, .env.*: pass

Code review:

• .github/workflows/run-tests.yml:91 -- the wait-for-server step is well-implemented: polls http://localhost:5000/SASjsApi/info up to 60 times (5s intervals, 300s max), dumps pm2 logs on timeout, exits 1 on failure. Good reliability improvement.
• src/commands/compile/compileSingleFile.ts:77 -- the ;( prefix added to (outputPathParts.pop(), outputPathParts.pop()) is Prettier ASI safety; the comma expression is pre-existing and functionally unchanged.
• src/commands/lint/processLint.ts:204 -- the ;( prefix and ternary reformatting are Prettier changes; the pre-existing comma-operator structure (process.logger?.table called with only the mapped array, { head: ... } evaluated as comma operand) is unchanged. Not a PR-introduced issue.
• src/types/command/spec/commandBase.spec.ts and src/utils/test.ts -- process.exit mock type widened to string | number | null | undefined to match newer @types/node. Correct migration.
• @sasjs/core major bump (4.68.1 to 5.2.2) and jsdom major bump (23 to 26) -- CI passes.
• CI passing (test runs green at node 22).

No blocking issues.

[4gl-reviewer]

Reviewed the diff (dependency refresh: TS 4->5, Jest 29->30, Prettier 2->3, jsdom 23->26; CI server-readiness step; .npmrc hardening verified, lockfile committed, npm ci + npm audit --audit-level=low in CI).

• package.json:72 — "@sasjs/adapter": "^4.19.0" uses a caret range; pin to an exact version (e.g. "4.19.0") for reproducible installs, consistent with the other pinned deps and the repo's save-exact=true policy.
  1 finding above for review.