merge from upstream 20261111

.github/dependabot.yml

@@ -5,7 +5,35 @@
 
 version: 2
 updates:
-  - package-ecosystem: "github-actions" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  # Enable version updates for our CI github-actions.
+  - package-ecosystem: "github-actions"
+    # For GitHub Actions, setting the directory to / will check for workflow
+    # files in .github/workflows.
+    directory: "/"
     schedule:
       interval: "weekly"
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    # The following is required for workspaces to be updated: see https://github.com/dependabot/dependabot-core/issues/5226.
+    versioning-strategy: increase
+    ignore:
+      - dependency-name: "eslint"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@typescript-eslint/eslint-plugin"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "typedoc-plugin-markdown"
+        update-types: ["version-update:semver-major"]
+    groups:
+      internal-tooling:
+        patterns:
+          - "@inrupt/internal-*"
+          - "@inrupt/base-*"
+          - "@inrupt/jest-*"
+          - "@inrupt/eslint-*"
+      external-types:
+        patterns:
+          - "@types/*"
+

.github/workflows/node.js.yml

@@ -18,7 +18,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [22.x, 24.x]
+        node-version: [22.x, 24.x, 26.x]
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
 
     steps:
@@ -29,7 +29,6 @@ jobs:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'
     - run: npm ci
-    # included in postinstall
-    # - run: npm run build --if-present
+    - run: npm run build
     - run: npm test
     - run: npm run lint:check

.github/workflows/npm-publish.yml

@@ -21,4 +21,5 @@ jobs:
           node-version-file: ".nvmrc"
           registry-url: "https://registry.npmjs.org"
       - run: npm ci
+      - run: npm run build
       - run: npm publish --workspace packages/webext --provenance

.npmrc

@@ -0,0 +1,2 @@
+# Prevent supply chain attacks targetting install scripts.
+ignore-scripts=true

.nvmrc

@@ -1 +1 @@
-24
+26

jest.config.ts

@@ -33,7 +33,6 @@ import { join } from "node:path";
 
 // Jest 30 loads .ts config files as ESM via Node's native TypeScript support,
 // so `require` is not available. Use createRequire for require.resolve calls.
-// @ts-expect-error: import.meta.url is valid at runtime (ESM), but tsconfig targets CJS.
 const esmRequire = createRequire(import.meta.url);
 
 type ArrayElement<MyArray> = MyArray extends Array<infer T> ? T : never;
@@ -72,10 +71,30 @@ const baseConfig: ArrayElement<NonNullable<Config["projects"]>> = {
 // loaded in the setup file.
 process.env.OPENSSL_CONF = "/dev/null";
 
+// Each package is analysed by Sonar as a separate project, using the package
+// directory as its base directory. In CI, an LCOV report is generated for each
+// package (in coverage/<package>/lcov.info), with source paths relative to the
+// package so that Sonar can resolve them. See the packages' sonar-project.properties.
+const SONAR_PACKAGES = ["webext"];
+const sonarCoverageReporters: Config["coverageReporters"] = SONAR_PACKAGES.map(
+  (packageName) => [
+    "lcovonly",
+    {
+      projectRoot: join(import.meta.dirname, "packages", packageName),
+      file: join(packageName, "lcov.info"),
+    },
+  ],
+);
+
 const config: JestConfigWithTsJest = {
+  // By default, Jest spawns one worker per CPU core (minus one), causing
+  // high memory usage for little to no performance gains.
+  maxWorkers: 2,
   reporters: ["default", "github-actions"],
   collectCoverage: true,
-  coverageReporters: process.env.CI ? ["text", "lcov"] : ["text"],
+  coverageReporters: process.env.CI
+    ? ["text", ...sonarCoverageReporters]
+    : ["text"],
   coverageThreshold: {
     global: {
       // branches: 100,