fix(deps): pin typescript so lockfile regeneration cannot break ESLint (supersedes #69)

[dknauss]

Supersedes #69. Carries that PR's websocket-driver 0.7.4 → 0.7.5 security bump and fixes the CI failure that blocked it.

What was failing

#69 failed Quality (Node 22) on Lint JavaScript:

TypeError: Failed to load plugin '@typescript-eslint' declared in
'--config » plugin:@wordpress/recommended': Cannot read properties of undefined (reading 'Intrinsic')

This was not branch staleness — @dependabot recreate reproduced it identically on top of current main.

Root cause

main's lockfile has no typescript entry at all. Regenerating the lockfile materialized typescript@7.0.2 — the native rewrite — plus twenty @typescript/typescript-* platform binaries.

ts-api-utils and tsutils declare a non-optional peer on typescript >=4.2.0, so npm installs one; unconstrained, it takes the newest. @typescript-eslint@6.21.0, pulled in transitively by @wordpress/scripts, supports >=4.7.4 <5.4.0 and crashes reading TypeScript internals that moved in 7.

So any lockfile regeneration — from any Dependabot PR, not just this one — would have hit the same wall.

The fix

One line in the existing overrides block:

"typescript": "~5.3.3"

That is the newest minor inside the range @typescript-eslint@6.21.0 supports, floating patches only, so it cannot drift into TS 5.4+ or 7. This project has no TypeScript source, so the pin costs nothing and the entry drops out of the tree entirely — matching main's state. A future @wordpress/scripts major that raises the ceiling will fail lint immediately rather than silently resolve into an incompatible pair again.

Nearly the whole diff is deletion: 400 removed lines are the TS7 tree. The 4 additions are "dev": true flags npm correctly added to encoding, iconv-lite, and safer-buffer, whose only consumer is a devDependency. No production dependency drift.

Verification

Clean npm ci --legacy-peer-deps, then the full Quality job: lint:js (the check that was failing) passes, lint:css clean, lint:i18n passed, npm audit --omit=dev --omit=optional 0 vulnerabilities, 660 Jest tests passing, build succeeds. websocket-driver confirmed at 0.7.5 in the installed tree — the security bump this PR exists to deliver survives the fix.

Risk

Low, and dev-only. No plugin runtime code or shipped dependency is affected; typescript was never in the distributed package.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.01%. Comparing base (4f35461) to head (0b6e689).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #72   +/-   ##
=======================================
  Coverage   81.01%   81.01%           
=======================================
  Files          43       43           
  Lines        3113     3113           
  Branches      522      522           
=======================================
  Hits         2522     2522           
  Misses        185      185           
  Partials      406      406           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.