Migration to Tanstack Config

[crutchcorn]

This PR:

• Migrates the code to TypeScript
• Migrates tests to Vitest
• Migrates ESLint to use default from TanStack Config
• Migrates build to Vite
• Adds Prettier for formatting
• Adds Knip
• Adds Publint
• Fixes Provide types for cjs #39, Incorrect Bundling Behavior #38, Downgrade lrucache #36
• Fixes issues with TypeScript types being found:
  

Future TODOs

This code was not particularly type-safe from the start, so there's a myriad of type-casting and ignoring TS that's not ideal.

At some point we should:

• Ban ! cast usage
• Ban as type casting
• Fix export types to be more strict
• Remove object and any usage
• Move Array types to tuple types
• Refactor code that overrides existing variable types to dedicated single-use types
• Review tests to use assert instead of expect

[asamuzaK]

I want to keep tests with assert.

[asamuzaK]

About tests:

• Rename *.test.js to *.test.ts
• In source, fix only imports:
  e.g. color.test.ts

  /* snip */
  import { strict as assert } from 'node:assert';
  import { describe, it } from 'vitest';
  
  /* test */
  import * as color from '../src/js/color'; // remove file extension

Will there be any problems if we fix tests as above?

[crutchcorn]

Also, I don't think that Vitest works with external asserts and, transparently, I'm not going to redo all of that work I did on tests.

Okay, please go with it.
Let's think about it later.

The first priority is to fix the issues.
It's OK to postpone things that we can think about later.

[crutchcorn]

OK all type casts should now be fixed as well @asamuzaK - this PR should be ready to review again

[crutchcorn]

Also, I tested this PR against my currently broken production usage of cssstyle and confirmed that this fixes it:

Before

After

[crutchcorn]

@asamuzaK can you handle the nit comments on your own after merging? It would be great to merge this so we can be unblocked on our projects using jsdom

I think this PR is ready to merge, since it's been tested and it seems like all review comments have been addressed

[asamuzaK]

@asamuzaK can you handle the nit comments on your own after merging? It would be great to merge this so we can be unblocked on our projects using jsdom

Sure.

[crutchcorn]

Ready for another round of reviews :)

[asamuzaK]

I've added reviewing tests in TODO.
Let's merge.
I'll add some fixes after that and release a new version ASAP.

[crutchcorn]

Thanks a bunch @asamuzaK! Feel free to tag me when you publish the new version and I'll make a PRs upstream to bump the package version there so JSDom can be unblocked :D

[crutchcorn]

I see that CI/CD is broken. I can fix that with a follow-up PR real fast

[asamuzaK]

There is also a security alert
https://github.com/asamuzaK/cssColor/security/dependabot/1

[asamuzaK]

npm audit report

cross-spawn <6.0.6
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - GHSA-3xgq-45jj-v275
No fix available
node_modules/execa/node_modules/cross-spawn
execa 0.5.0 - 0.9.0
Depends on vulnerable versions of cross-spawn
node_modules/execa
current-git-branch *
Depends on vulnerable versions of execa
Depends on vulnerable versions of is-git-repository
node_modules/current-git-branch
@tanstack/config *
Depends on vulnerable versions of current-git-branch
node_modules/@tanstack/config
is-git-repository <=1.1.1
Depends on vulnerable versions of execa
node_modules/is-git-repository

I think @tanstack/config need to replace current-git-branch with something.
It's not updated over 6 years.
https://www.npmjs.com/package/current-git-branch?activeTab=code

[crutchcorn]

I'll forward to the team, but this shouldn't block merging on this project in particular. current-git-branch is only used in the publish script which is not used here and only on dev mode.