Reduce runtime dependencies from 17 packages to 10

[nvuillam]

Shrinks the supply-chain surface by removing dependencies that node built-ins cover, without any change to the public API.

Runtime: 17 packages -> 10

Removed	Why	Packages dropped
fs-extra	3 of 7 call sites (existsSync, statSync) were plain node:fs re-exports; the rest are one-liners on fs.promises / JSON.parse	fs-extra, graceful-fs, jsonfile, universalify
debug	replaced by a ~10 line local helper	debug, ms
(yauzl bump)	newer yauzl no longer needs it	buffer-crc32

njre and semver are kept: njre is the whole point of the library, and semver's coerce is what parses Java's 1.8.0_292-style versions.

DEBUG=java-caller still works exactly as documented. util.debuglog was not usable as a replacement because it only reads NODE_DEBUG from the environment the process was launched with, so it could not honour the existing contract. Verified: DEBUG=java-caller and DEBUG=java-caller,njre both emit traces, unset emits nothing.

Dev: which removed

Used once, to locate the java binary in a test. Its engines field is ^22.22.2 || ^24.15.0 || >=26.0.0, which excludes Node 18 and 20 from our own CI matrix (npm was already printing EBADENGINE on every install). Replaced by a findInPath helper in test/helpers/common.js that honours PATHEXT on Windows.

Fixes found along the way

• engines was wrong: it claimed node >=12.0.0, but njre@3 requires >=18 and every dev tool needs 18+. Anyone installing on Node 12-16 got a tree that could not work. Now >=18.0.0.
• npm run lint was already broken on main: ESLint 10 stopped hoisting @eslint/js and globals, which eslint.config.js requires, so the script failed before linting anything. CI never ran it (MegaLinter uses its own eslint), so nothing caught it. They are now declared as devDependencies, and a Lint job runs npm run lint in CI.
• Dead overrides removed: @babel/core and uuid matched zero packages in the tree. Stale pins like these are what caused the EOVERRIDE lockfile failure on Update all non-major dependencies #185.

Verification

• npm run test: 36 passing, including the real njre install paths that exercise the replaced mkdir/writeFile/readdir/statSync calls
• npm run lint: clean (eslint + prettier)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	globals@​17.9.0
	@​eslint/​js@​10.0.1

View full report

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
⚠️ ACTION	actionlint	4		2		0	0.06s
✅ ACTION	zizmor	4		0		0	2.08s
✅ COPYPASTE	jscpd	yes		no		no	0.76s
✅ JAVASCRIPT	eslint	11		0		0	0.75s
✅ JSON	jsonlint	9		0		0	0.08s
✅ JSON	npm-package-json-lint	yes		no		no	0.33s
✅ JSON	prettier	9		0		0	0.3s
✅ JSON	v8r	9		0		0	17.46s
⚠️ MARKDOWN	markdownlint	7		18		0	0.62s
⚠️ MARKDOWN	markdown-table-formatter	7		1		0	0.18s
✅ REPOSITORY	betterleaks	yes		no		no	0.65s
✅ REPOSITORY	checkov	yes		no		no	21.21s
✅ REPOSITORY	git_diff	yes		no		no	0.02s
✅ REPOSITORY	grype	yes		no		no	62.7s
✅ REPOSITORY	osv-scanner	yes		no		no	0.47s
✅ REPOSITORY	secretlint	yes		no		no	1.42s
✅ REPOSITORY	syft	yes		no		no	1.64s
✅ REPOSITORY	trivy	yes		no		no	11.78s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.21s
✅ REPOSITORY	trufflehog	yes		no		no	4.32s
✅ SPELL	cspell	40		0		0	3.81s
⚠️ SPELL	lychee	27		4		0	55.09s
✅ TYPESCRIPT	eslint	1		0		0	0.26s
✅ TYPESCRIPT	prettier	1		0		0	0.31s
⚠️ TYPESCRIPT	ts-standard	1		1		0	0.3s
✅ YAML	prettier	9		0		0	0.43s
✅ YAML	v8r	9		0		0	8.47s
✅ YAML	yamllint	9		0		0	0.53s

Detailed Issues

⚠️ ACTION / actionlint - 2 errors

.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:15: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~
.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:21: Double quote to prevent globbing and word splitting [shellcheck]
   |
55 |         run: sudo chown -R $USER:$USER .
   |         ^~~~

⚠️ SPELL / lychee - 4 errors

📝 Summary
---------------------
🔍 Total...........75
🔗 Unique..........63
✅ Successful......24
⏳ Timeouts.........0
🔀 Redirected.......7
👻 Excluded........47
❓ Unknown..........0
🚫 Errors...........4
⛔ Unsupported......4

Errors in README.md
[403] https://npmjs.org/package/java-caller (at 5:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://npmjs.org/package/java-caller (at 6:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://www.npmjs.com/package/java-caller (at 4:1) | Rejected status code: 403 Forbidden
[403] https://www.npmjs.com/package/njre (at 16:145) | Rejected status code: 403 Forbidden

Hint: Followed 7 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

⚠️ MARKDOWN / markdown-table-formatter - 1 error

1 files contain markdown tables to format:
- README.md

⚠️ MARKDOWN / markdownlint - 18 errors

CHANGELOG.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 442]
CODE_OF_CONDUCT.md:58:44 error MD034/no-bare-urls Bare URL used [Context: "nicolas.vuillamy@gmail.com"]
CODE_OF_CONDUCT.md:71:14 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
CODE_OF_CONDUCT.md:76:1 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:47 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:1 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:67:361 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:69:123 error MD060/table-column-style Table column style [Table pipe has extra space to the left for style "compact"]
README.md:73:315 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:74:310 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:75:208 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:76:233 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]

⚠️ TYPESCRIPT / ts-standard - 1 error

Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository