chore: auto-audit hygiene fixes

.config/.cprc.json

@@ -1,4 +1,4 @@
 {
-  "version": "7.0.0",
+  "version": "7.7.0",
   "features": {}
 }

.config/tsconfig.json

@@ -9,15 +9,18 @@
     "alwaysStrict": true,
     "declaration": false,
     "rootDir": "../src",
-    "baseUrl": "../src",
     "typeRoots": ["../node_modules/@types"],
-    "resolveJsonModule": true
+    "resolveJsonModule": true,
+    "paths": {
+      "*": ["../src/*"]
+    }
   },
   "ts-node": {
     "compilerOptions": {
-      "module": "commonjs",
-      "target": "es5",
-      "esModuleInterop": true
+      "module": "nodenext",
+      "target": "es2022",
+      "esModuleInterop": true,
+      "moduleResolution": "nodenext"
     },
     "transpileOnly": true
   },

.github/workflows/add-to-project.yml

@@ -7,12 +7,11 @@ on:
     types:
       - opened
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   add-to-project:
+    permissions:
+      contents: read
+      id-token: write
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:

.github/workflows/publish.yaml

@@ -1,10 +1,5 @@
 name: Plugins - CD
 run-name: Deploy ${{ inputs.branch }} to ${{ inputs.environment }} by @${{ github.actor }}
-permissions:
-  attestations: write
-  contents: write
-  id-token: write
-  pull-requests: read
 
 on:
   workflow_dispatch:
@@ -27,6 +22,11 @@ on:
 
 jobs:
   cd:
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+      pull-requests: read
     name: CD
     uses: grafana/plugin-ci-workflows/.github/workflows/cd.yml@ci-cd-workflows/v8.0.1
     with:

.github/workflows/push.yaml

@@ -1,7 +1,4 @@
 name: Plugins - CI
-permissions:
-  contents: read
-  id-token: write
 
 on:
   push:
@@ -13,6 +10,9 @@ on:
 
 jobs:
   ci:
+    permissions:
+      contents: read
+      id-token: write
     name: CI
     uses: grafana/plugin-ci-workflows/.github/workflows/ci.yml@ci-cd-workflows/v8.0.1
     with:

.github/workflows/update-create-plugin.yml

@@ -5,13 +5,12 @@ on:
   schedule:
     - cron: '0 0 1 * *' # run once a month on the 1st day
 
-permissions:
-  contents: write
-  id-token: write # Needed for create-github-app-token
-  pull-requests: write
-
 jobs:
   release:
+    permissions:
+      contents: write
+      id-token: write # Needed for create-github-app-token
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - id: get-github-token

.nvmrc

@@ -1 +1 @@
-24
+24.15.0

.yarnrc.yml

@@ -1,5 +1,22 @@
-nodeLinker: node-modules
+# Do not under any circumstances add approvedGitRepositories to this file.
+# It is a security risk that would allow arbitrary code execution both locally and in CI.
+# https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories
+defaultSemverRangePrefix: ""
 
-yarnPath: .yarn/releases/yarn-4.14.1.cjs
+enableImmutableInstalls: true
 
 enableScripts: false
+
+nmHoistingLimits: workspaces
+
+nodeLinker: node-modules
+
+npmMinimalAgeGate: 4320
+
+# Bypass minimal age gate for specific grafana packages to make feature development easier.
+npmPreapprovedPackages:
+  - "@grafana/*"
+
+npmRegistryServer: "https://registry.npmjs.org"
+
+yarnPath: .yarn/releases/yarn-4.15.0.cjs

go.mod

@@ -1,6 +1,6 @@
 module github.com/grafana/github-datasource
 
-go 1.26.1
+go 1.26.3
 
 require (
 	github.com/bradleyfalzon/ghinstallation/v2 v2.18.0

package.json

@@ -13,7 +13,7 @@
     "lint": "eslint --cache .",
     "lint:fix": "yarn run lint --fix && prettier --write --list-different .",
     "server": "docker compose up --build",
-    "sign": "npx --yes @grafana/sign-plugin@latest",
+    "sign": "sign-plugin",
     "spellcheck": "cspell -c cspell.config.json \"**/*.{ts,tsx,js,go,md,mdx,yml,yaml,json,scss,css}\"",
     "test": "jest --watch --onlyChanged",
     "test:ci": "jest --passWithNoTests --maxWorkers 4",
@@ -39,6 +39,7 @@
     "@grafana/eslint-config": "9.0.0",
     "@grafana/plugin-e2e": "3.7.1",
     "@grafana/plugin-meta-extractor": "0.12.2",
+    "@grafana/sign-plugin": "^3.2.2",
     "@grafana/tsconfig": "2.1.0",
     "@openfeature/web-sdk": "1.8.0",
     "@playwright/test": "1.59.1",
@@ -98,5 +99,9 @@
     "i18next": "26.0.8",
     "dompurify": "3.4.2"
   },
-  "packageManager": "yarn@4.14.1"
+  "packageManager": "yarn@4.15.0",
+  "engines": {
+    "node": ">=24",
+    "yarn": ">=4.15.0"
+  }
 }