build: bump @electron/lint-roller to ^4.0.0

[claude]

Requested by David Sanders · Slack thread

Before: @electron/lint-roller was pinned at ^3.1.3 (lockfile resolved 3.1.3), which still shipped the eslint-based lint-roller-markdown-standard bin and its ~120-package eslint dependency tree.

After: @electron/lint-roller is ^4.0.0 (lockfile resolves 4.0.0). No script changes were needed: the only lint-roller usage in this repo is lint:links (lint-roller-markdown-links "*.md"), which uses none of the removed flags, and .markdownlint.json extends @electron/lint-roller/configs/markdownlint.json, which still exists.

Notes

• Breaking changes in 4.0.0 vs this repo:
  • lint-roller-markdown-standard was removed (replaced by lint-roller-markdown-oxlint). Not used here.
  • lint-roller-markdown-links dropped --fetch-external-links and --check-redirects. Neither flag is used here.
  • Node floor is now ^22.17.0 || >=24.0.0. .nvmrc is 22.17, release.yml uses 22.17.x, and coveralls.yml uses 22.x, so CI is fine. engines.node is >= 22.12.0, which is below the new floor; left unchanged in this PR but may be worth bumping separately.
  • New optional peer deps: oxlint >= 1.65.0 (satisfied by the existing oxlint@^1.81.0 devDep) and oxfmt >= 0.20.0 (not installed; only needed for the new optional lint-roller-markdown-oxfmt bin, which this repo does not use). yarn install emitted no lint-roller peer warnings.
• Tests: yarn lint:links, yarn lint:markdown, and the full yarn lint all pass on Node 22.22.2.
• Lockfile delta: yarn.lock +43/-1302 lines (the eslint/standard tree is gone). package.json is a one-line change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MpGBviMFFyBDsWe7wfW3eV

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​electron/​lint-roller@​3.1.3 ⏵ 4.0.0	+10		+6	+3

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• @electron/lint-roller@4.0.0

View full report

[coveralls]

coverage: 87.352%. remained the same — lint-roller-4 into main

[dsanders11]

@SocketSecurity ignore npm/@electron/lint-roller@4.0.0

[claude]

Looks good, straightforward devDependency version bump.

Extended reasoning...

Overview

This PR only touches package.json (one line, bumping @ electron/lint-roller from ^3.1.3 to ^4.0.0) and the regenerated yarn.lock. No source files are changed.

Security risks

None. This is a devDependency-only change with no runtime/production code impact. The lockfile diff shows removal of the eslint-based transitive tree that came with lint-roller 3.x's removed lint-roller-markdown-standard bin, which is expected and reduces the dependency surface rather than expanding it.

Level of scrutiny

Low. Verified directly: the repo's only lint-roller usage is lint-roller-markdown-links via the lint:links script, which does not use either of the two flags dropped in 4.0.0 (--fetch-external-links, --check-redirects). .markdownlint.json still extends @ electron/lint-roller/configs/markdownlint.json, and the lockfile confirms the package resolves to npm:^4.0.0 with no broken peer resolution. This matches the PR description's claims.

Other factors

Already approved by dsanders11 (human reviewer) with no outstanding objections in the timeline. The change is mechanical, self-contained, and low risk, consistent with the approval guidelines for version bumps with no ambiguity.