chore: fix format glob, gate stale dist/ in CI, drop dead config

[joris974]

Nine independent commits, rebased onto main at #278.

chore: fix the prettier format glob to target .ts sources

format was prettier --write 'src/**/*.js'. Every source in src/ is .ts, so the glob matched nothing and prettier treated that as an error:

$ pnpm format
[error] No files matching the pattern were found: "src/**/*.js".
[ELIFECYCLE] Command failed with exit code 2.

There is no formatting backlog behind it. .restyled.yaml already lists src/**/*.ts under its prettier restyler, so the bot has been formatting these files all along, and pnpm format with the fixed glob reports all six files unchanged.

ci: check for stale dist/ with check-git-clean-action

dist/ is committed, but no workflow verified it matched src/, so a PR could merge with the two out of sync. check-git-clean.sh and the check-git-clean script existed for this and nothing called them. The script was also committed without its executable bit (100644), so pnpm check-git-clean died with Permission denied regardless.

Both are replaced by freckle/check-git-clean-action@v1, matching ajax-js after freckle/ajax-js#200. The action checks git status --porcelain --untracked-files=normal, so it also catches untracked build output that the script's git diff missed.

chore: remove dead eslint-disable comment

src/formatting.ts carried a no-prototype-builtins directive. There's no eslint config and no eslint dependency, and neither CI nor .restyled.yaml runs a linter, so nothing read it.

It was also being emitted into dist/formatting.js, since tsc preserves comments by default. The rebuilt dist/ joins the arrow body back onto one line now that the comment no longer splits it. Normalising whitespace on both sides shows the emitted code is otherwise identical.

chore: drop deprecated jsxBracketSameLine from prettier config

Prettier warns jsxBracketSameLine is deprecated on every run. Its replacement is bracketSameLine, whose default of false matches the value set here, so removing the option leaves formatting unchanged. This package has no JSX either way.

fix(release): pin conventional-changelog-conventionalcommits to the major

#268 pinned the exact patch, 9.3.1. Pinning the major keeps patch and minor releases flowing while still excluding 10.x, which requires conventional-changelog-writer@9+ that the bundled @semantic-release/release-notes-generator doesn't provide. Matches maybe-js and ajax-js.

chore: remove the PR checklist comment

#272 left the comment with one item: that dist/ reflect the changes in the PR. The check-git-clean-action step added in this branch now fails the build on exactly that, so the comment has nothing left to tell a reviewer. The config and the workflow that posts it both go, matching ajax-js after freckle/ajax-js#203.

chore: add trailing newline to .gitignore

The whitespace restyler covers **/*, excluding only dist/ and flow/.

chore: drop dead restyled globs

The prettier restyler listed src/**/*.js alongside src/**/*.ts. src/ holds only .ts files and no .js has ever been tracked there, so the first glob matched nothing. The whitespace restyler excluded flow/, which has never existed in this repo's history.

chore(deps): refresh the lockfile to clear dev-tree advisories

Eight open Dependabot alerts, all development scope, were stale lockfile pins rather than range constraints. vitest@^4.1.11 already permits vite ^6 || ^7 || ^8, so package.json needed no change:

vite     7.3.1  -> 8.2.2   (3 high, 2 moderate)
postcss  8.5.15 -> 8.5.26  (1 high, 1 moderate)
esbuild  0.27.7 -> dropped (1 low)

vite 8 does not depend on esbuild, so that subtree leaves entirely: 81 esbuild references in the lockfile become 2, both an optional peer range that nothing installs. The lockfile shrinks by 570 lines.

Worth knowing for reproducing it: pnpm update and rm pnpm-lock.yaml both no-op, since pnpm rebuilds an identical lock from node_modules. It took rm -rf node_modules pnpm-lock.yaml && pnpm install --force.

Verification

Ran the sequence ci.yml now defines: pnpm install --frozen-lockfile, pnpm build, pnpm test (82 tests pass), then the action's own check, git status --porcelain --untracked-files=normal, which comes back empty.

Not covered here

Three open Dependabot alerts against lodash at runtime scope come in through @freckle/non-empty@^3.0.0, which pins lodash 4.17.21:

lodash@4.17.21 └─┬ @freckle/non-empty@3.0.0 └── @freckle/parser (dependencies)

GHSA-r5fr-rjxr-66jc (high), GHSA-f23m-r3pf-42rh and GHSA-xxjr-mmjv-4gpg (moderate), all fixed in lodash 4.18.0. Bumping to @freckle/non-empty@^4 is not a way out: v4.0.1 cannot be imported by any ESM consumer. Its dist/index.js:1 is import { first, flatten, last, map, sortBy } from 'lodash', and lodash is CommonJS with no named ESM exports, so node --input-type=module -e "import {mkNonEmpty} from '@freckle/non-empty'" throws SyntaxError: Named export 'first' not found. These alerts need a fix in non-empty-js first.

@freckle/non-empty also ships declarations that import ArrayIterator and ListIterator from lodash while listing @types/lodash only in devDependencies, so consumers with skipLibCheck: false get TS2307. That needs fixing in non-empty-js.