Modernize dependencies and use built-ins

[james-pre]

I got annoyed with deprecated transitive dependencies in electron-builder and figured I would fix it myself.

I got a bit carried away, so this PR has a bunch of changes (though all good ones I hope):

• Replaced fs-extra dependency with built-in fs functions that are already available in Node.js 22
• Removed dependency on lodash (fixes Stop Using Lodash #549)
• Upgraded eslint from v8 to v10
• Replaced ava dev. dependency with built-in node:test
• Replaced ts-node dev. dependency with tsx
• Upgraded @electron/asar from 3.x to 4.x (fixes Dependency on old version of @electron/asar #611)
• Upgraded typedoc
• Replaced debug with obug (this was to fix missing debug types but it doesn't hurt to reduce install size)
• Upgraded Typescript from 5.4 to 5.7
• Switched to ESM (shouldn't affect consumers since require(esm) is supported across all maintained versions of Node.js)
• Bumped Node.js engine from 22.12 to 22.13

Note that this PR subsumes #599, #598, #617.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript-eslint@​8.70.0
	@​stylistic/​eslint-plugin@​5.10.0
	@​types/​node@​20.6.0 ⏵ 22.20.3				+1
	tsx@​4.23.13
	globals@​13.21.0 ⏵ 17.12.0			-2	+1
	@​eslint/​js@​8.49.0 ⏵ 10.0.1			+13
	@​electron/​asar@​3.2.1 ⏵ 4.3.0	+1			+6
	typescript@​5.4.5 ⏵ 5.9.3
	typedoc@​0.25.13 ⏵ 0.28.20				+1
	obug@​3.0.0
	eslint@​8.49.0 ⏵ 10.10.0	+1			+46

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Recently published: npm @types/node published 21 hours ago Location: Package overview From: package.json → npm/@types/node@22.20.3 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@types/node@22.20.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: npm brace-expansion published 2 days ago Location: Package overview From: yarn.lock → npm/typedoc@0.28.20 → npm/@electron/asar@4.3.0 → npm/eslint@10.10.0 → npm/typescript-eslint@8.70.0 → npm/brace-expansion@5.0.12 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/brace-expansion@5.0.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: npm markdown-it published 5 days ago Location: Package overview From: yarn.lock → npm/typedoc@0.28.20 → npm/markdown-it@14.3.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/markdown-it@14.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: npm yaml published 5 days ago Location: Package overview From: yarn.lock → npm/typedoc@0.28.20 → npm/yaml@2.9.1 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yaml@2.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[dsanders11]

Hi @james-pre, thanks for the PR! These changes are in general good, but as a general policy we don't allow external contributors to change our lockfiles this extensively, for security reasons. We also need to manage the release process here regarding breaking changes and the next major version (something that is already in-progress, albeit slowly). Some of these changes we'll likely pick up ourselves, others probably not (we're migrating to oxlint org-wide, for example). Given all of that, I'm going to close out this PR, but thank you for the effort!