Migrate from yarn to npm and fix undici advisories

[ricardobcl]

Description

Migrates the project from yarn to npm and fixes the two high severity undici advisories reported by npm audit.

The work is split into two commits:

Migrate from yarn to npm — replaces yarn.lock with package-lock.json, switches both workflows to npm ci / npm run <script>, and updates the README. Dependency caching is now handled by actions/setup-node through cache: npm.

npm's stricter peer dependency resolution surfaced two pre-existing issues that yarn silently ignored, both of which had to be fixed for npm install to resolve at all:

• eslint ~9.28.0 → ~9.39.2. eslint-config-uphold@^6.5.2 now resolves to 6.13.0, which requires eslint@~9.39.2. The old lockfile pinned config 6.5.2 with eslint@9.28.0, a pair that was consistent when written but has drifted since.
• Added eslint-plugin-mocha@^11.3.0. That same config version moved it from a dependency to an optional peer dependency, so npm no longer installs it, yet the config still imports it unconditionally — linting failed with ERR_MODULE_NOT_FOUND until it was added explicitly. The other optional peers (jest, vitest, typescript-eslint) are loaded lazily and degrade gracefully, so they are not needed.

Update release-it@21.0.2 — release-it@19 depends on undici@6.23.0, which carries the advisories. Version 21 is the first release to depend on undici@7.29.0, where they are resolved (v20 ships 7.28.0, which is still flagged).

release-it@21 requires Node ^22.21.0 || >=24.0.0, so Node 20 is dropped from engines and from the test matrix.

Related issues

N/A

Impacted areas

Build tooling and CI only. No changes to src or types, so the published package contents are unchanged.

Steps to reproduce or test

Development

Verified from a clean checkout of the branch:

rm -rf node_modules && npm ci   # exits 0, no EBADENGINE warnings
npm run lint                    # exits 0
npm test                        # 52/52 passing
npm run test:coverage           # 100% across all files
npm audit                       # found 0 vulnerabilities

Also confirmed .release-it.js still parses under release-it@21 — npx release-it --release-version loads the config and proceeds to the expected "working dir must be clean" check.

QA

N/A — no runtime behaviour changes.

Checklist

• Add label Breaking Change if it applies.
• Commits are atomic and logically separated.
• Performance implications have been considered.
• Security implications have been considered.
• The new and updated code has good coverage.
• API documentation, if required, has been created or updated.
• New dependencies have been added to package.json.
• The README file, if required, has been updated.
• Architectural diagram, if required, has been updated.

Deploy notes

Dropping Node 20 from engines is a breaking change for consumers, so the next release should be a major bump (3.0.0) rather than a patch. The release workflow takes the bump type as a manual input, so this needs to be selected explicitly.

[Copilot]

Pull request overview

This PR migrates the repository’s tooling/CI from Yarn to npm and updates tooling dependencies to address undici security advisories pulled in via release-it.

Changes:

• Replace Yarn-based installs/commands with npm ci / npm run … and enable npm caching in GitHub Actions.
• Add/adjust dev tooling dependencies (notably release-it@21, eslint@9.39.2, and eslint-plugin-mocha) to resolve npm’s peer dependency requirements and fix undici advisories.
• Update README usage snippets to reflect npm commands and remove the Yarn lockfile in favor of package-lock.json.

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
yarn.lock	Removed Yarn lockfile as part of migration to npm.
package-lock.json	New npm lockfile; confirms release-it@21 pulls undici@7.29.0.
package.json	Updates devDependencies and raises Node engine requirement for the project.
README.md	Updates install/test commands to npm equivalents.
.github/workflows/tests.yaml	Switches CI installs and script invocations from Yarn to npm; drops Node 20 from matrix.
.github/workflows/release.yaml	Switches release workflow installs and script invocations from Yarn to npm; enables npm cache.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Kamefrede]

LGTM