chore(deps-dev): eslint 10 and vitest 4, holding typescript at 5

[cubehouse]

Supersedes #27, which cannot go green as a group.

#27 bundles three majors: eslint 9 → 10, vitest 1 → 4, and typescript 5 → 6. The first two are fine. The third is blocked upstream, and it takes the whole group down with it.

Why typescript 6 cannot land here

openapi-typescript@7.13.0, the newest release, still declares:

peerDependencies = { typescript: '^5.x' }

So a clean npm ci with TypeScript 6 fails to resolve before any build runs:

Could not resolve dependency:
peer typescript@"^5.x" from openapi-typescript@7.13.0
Conflicting peer dependency: typescript@5.9.3

openapi-typescript is a real dependency here — scripts/regenerate.ts uses it to build src/_generated/schema.ts — so it cannot simply be dropped. Nothing in this repo can fix it; the peer range has to widen upstream.

A second thing waiting behind it

Worth writing down now so it is not rediscovered later. Even with the peer conflict forced past, TypeScript 6 breaks tsup --dts:

error TS5101: Option 'baseUrl' is deprecated and will stop functioning in TypeScript 7.0.

This repo's tsconfig.json does not set baseUrl. tsup does: tsup@8.5.1 hardcodes baseUrl: compilerOptions.baseUrl || "." in its declaration build (node_modules/tsup/dist/rollup.js:6837). Adding "ignoreDeprecations": "6.0" clears it and the build then succeeds, but that option is itself a countdown — TypeScript 7 removes baseUrl outright. The durable fix is a tsup release that stops injecting it, or moving declaration emit to tsc.

What this PR does

Takes the two majors that work, holds typescript at ^5.4.0. No config or source change was needed.

	Result
npm ci	clean
npm run typecheck	pass
npm run lint	pass
npm test	11 files, 64 tests, pass
npm run build	pass
npm run test:live	4 tests against the live API, pass

dist/index.d.ts is byte-identical to the one built from main, so the published type surface does not move.

🤖 Generated with Claude Code

[cubehouse]

Pushed a second commit: the Node 18 lane is dropped and the tested floor moves to 20.

eslint 10 and vitest 4 both declare Node 20+ (^20.19.0 || ^22.13.0 || >=24 and ^20.0.0 || ^22.0.0 || >=24.0.0), so Node 18 fails at npm ci while 20 and 22 pass. Node 18 has been end-of-life since 2025-04-30.

The constraint is dev-toolchain only — nothing in the shipped bundle needs Node 20. So the choice was between dropping the lane while still advertising engines: >=18, and withdrawing a claim nothing verifies. This does the second: matrix to 20/22/24, engines to >=20, README and CHANGELOG updated. Anyone still on Node 18 stays on 7.1.x.

Before this can merge: branch protection still requires Test (Node 18), which no longer exists. Required contexts need to become Test (Node 20), Test (Node 22), Test (Node 24), or the PR stays blocked on a check that can never report.