@salesforce/core 9.1.4 → 9.1.6

package/lib/config/config.js

@@ -336,7 +336,6 @@ class Config extends configFile_1.ConfigFile {
             await super.read(false, force);
             if (global_1.Global.SFDX_INTEROPERABILITY) {
                 // will exist if Global.SFDX_INTEROPERABILITY is enabled
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
                 this.contents.merge(stateFromSfdxFileSync(this.sfdxPath, this));
             }
             await this.cryptProperties(false);
@@ -350,7 +349,6 @@ class Config extends configFile_1.ConfigFile {
         super.readSync(false, force);
         if (global_1.Global.SFDX_INTEROPERABILITY) {
             // will exist if Global.SFDX_INTEROPERABILITY is enabled
-            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             this.contents.merge(stateFromSfdxFileSync(this.sfdxPath, this));
         }
         return this.getContents();
@@ -366,7 +364,6 @@ class Config extends configFile_1.ConfigFile {
         await super.write();
         if (global_1.Global.SFDX_INTEROPERABILITY) {
             // will exist if Global.SFDX_INTEROPERABILITY is enabled
-            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             await writeToSfdx(this.sfdxPath, this.getContents());
         }
         await this.cryptProperties(false);
@@ -449,7 +446,6 @@ class Config extends configFile_1.ConfigFile {
      *
      * @param propertyName The name of the property.
      */
-    // eslint-disable-next-line class-methods-use-this
     getPropertyConfig(propertyName) {
         const prop = Config.propertyConfigMap()[propertyName];
         if (!prop) {

package/lib/config/configStore.js

@@ -354,7 +354,6 @@ class BaseConfigStore extends kit_1.AsyncOptionalCreatable {
         }
         else if (this.isCryptoKey(key)) {
             // I think this side effect is intentional
-            // eslint-disable-next-line no-param-reassign
             data[key] = method(value);
         }
     }

package/lib/crypto/crypto.js

@@ -68,6 +68,10 @@ const KEY_SIZE = {
 };
 const ALGO = 'aes-256-gcm';
 const AUTH_TAG_LENGTH = 32;
+// The GCM authentication tag length in bytes. AUTH_TAG_LENGTH is the hex-encoded
+// string length, so the byte length is half of that. Pinning this on decryption
+// prevents forged ciphertexts that use shorter-than-expected tags.
+const AUTH_TAG_BYTE_LENGTH = AUTH_TAG_LENGTH / 2;
 const ENCRYPTED_CHARS = /[a-f0-9]/;
 const KEY_NAME = 'sfdx';
 const ACCOUNT = 'local';
@@ -206,7 +210,6 @@ class Crypto extends kit_1.AsyncOptionalCreatable {
         this.options = options ?? {};
     }
     // @ts-expect-error only for test access
-    // eslint-disable-next-line class-methods-use-this
     static unsetCryptoVersion() {
         cryptoVersion = undefined;
     }
@@ -339,7 +342,9 @@ class Crypto extends kit_1.AsyncOptionalCreatable {
         const iv = tokens[0].substring(0, IV_BYTES.v1 * 2);
         const secret = tokens[0].substring(IV_BYTES.v1 * 2, tokens[0].length);
         return this.key.value((buffer) => {
-            const decipher = crypto.createDecipheriv(ALGO, buffer.toString('utf8'), iv);
+            const decipher = crypto.createDecipheriv(ALGO, buffer.toString('utf8'), iv, {
+                authTagLength: AUTH_TAG_BYTE_LENGTH,
+            });
             try {
                 decipher.setAuthTag(Buffer.from(tag, 'hex'));
                 return `${decipher.update(secret, 'hex', 'utf8')}${decipher.final('utf8')}`;
@@ -359,7 +364,9 @@ class Crypto extends kit_1.AsyncOptionalCreatable {
         const iv = tokens[0].substring(0, IV_BYTES.v2 * 2);
         const secret = tokens[0].substring(IV_BYTES.v2 * 2, tokens[0].length);
         return this.key.value((buffer) => {
-            const decipher = crypto.createDecipheriv(ALGO, buffer, Buffer.from(iv, 'hex'));
+            const decipher = crypto.createDecipheriv(ALGO, buffer, Buffer.from(iv, 'hex'), {
+                authTagLength: AUTH_TAG_BYTE_LENGTH,
+            });
             try {
                 decipher.setAuthTag(Buffer.from(tag, 'hex'));
                 return `${decipher.update(secret, 'hex', 'utf8')}${decipher.final('utf8')}`;

package/lib/deviceOauthService.js

@@ -14,13 +14,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-/* eslint-disable camelcase */
-/* eslint-disable @typescript-eslint/ban-types */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeviceOauthService = void 0;
+/* eslint-disable @typescript-eslint/ban-types */
 const transport_1 = __importDefault(require("@jsforce/jsforce-node/lib/transport"));
 const kit_1 = require("@salesforce/kit");
 const ts_types_1 = require("@salesforce/ts-types");

package/lib/logger/logger.js

@@ -353,7 +353,7 @@ class Logger {
      *
      * @param cb A callback that returns on array objects to be logged.
      */
-    // eslint-disable-next-line class-methods-use-this, @typescript-eslint/no-unused-vars, @typescript-eslint/no-empty-function
+    // eslint-disable-next-line class-methods-use-this, @typescript-eslint/no-unused-vars
     debugCallback(cb) { }
     /**
      * Logs at `info` level with filtering applied. For convenience `this` object is returned.
@@ -456,9 +456,7 @@ const levelFromOption = (value) => {
     }
 };
 // /** match a number to a pino level, or if a match isn't found, the next highest level */
-const numberToLevel = (level) => pino_1.levels.labels[level] ??
-    Object.entries(pino_1.levels.labels).find(([value]) => Number(value) > level)?.[1] ??
-    'warn';
+const numberToLevel = (level) => pino_1.levels.labels[level] ?? Object.entries(pino_1.levels.labels).find(([value]) => Number(value) > level)?.[1] ?? 'warn';
 const getDefaultLevel = () => {
     const logLevelFromEnvVar = new kit_1.Env().getString('SF_LOG_LEVEL');
     return logLevelFromEnvVar ? Logger.getLevelByName(logLevelFromEnvVar) : Logger.DEFAULT_LEVEL;

package/lib/logger/transformStream.js

@@ -19,7 +19,7 @@ exports.default = default_1;
 const node_stream_1 = require("node:stream");
 const unwrapArray_1 = require("../util/unwrapArray");
 const filters_1 = require("./filters");
-// eslint-disable-next-line @typescript-eslint/no-var-requires, @typescript-eslint/no-unsafe-assignment
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
 const build = require('pino-abstract-transport');
 function default_1() {
     // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-call

package/lib/org/authInfo.js

@@ -825,9 +825,9 @@ class AuthInfo extends kit_1.AsyncOptionalCreatable {
             const error = err;
             if (error?.message?.includes('Data Not Available')) {
                 // Set cause to keep original stacktrace
-                return await callback(messages.createError('orgDataNotAvailableError', [this.getUsername()], [], error));
+                return callback(messages.createError('orgDataNotAvailableError', [this.getUsername()], [], error));
             }
-            return await callback(error);
+            return callback(error);
         }
     }
     async readJwtKey(keyFile) {
@@ -951,11 +951,9 @@ class AuthInfo extends kit_1.AsyncOptionalCreatable {
      */
     async exchangeToken(options, oauth2 = new jsforce_node_1.OAuth2(options)) {
         if (!oauth2.redirectUri) {
-            // eslint-disable-next-line no-param-reassign
             oauth2.redirectUri = this.getRedirectUri();
         }
         if (!oauth2.clientId) {
-            // eslint-disable-next-line no-param-reassign
             oauth2.clientId = this.getClientId();
         }
         // Exchange the auth code for an access token and refresh token.

package/lib/org/authRemover.js

@@ -109,9 +109,7 @@ class AuthRemover extends kit_1.AsyncOptionalCreatable {
      */
     findAllAuths() {
         const orgs = this.stateAggregator.orgs.getAll();
-        return orgs.reduce((x, y) => 
-        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-        ({ ...x, [y.username]: y }), {});
+        return orgs.reduce((x, y) => ({ ...x, [y.username]: y }), {});
     }
     async init() {
         this.logger = await logger_1.Logger.child(this.constructor.name);

package/lib/org/connection.js

@@ -337,8 +337,7 @@ class Connection extends jsforce_node_1.Connection {
         }
         if (result.totalSize > 1) {
             throw new sfError_1.SfError(options.returnChoicesOnMultiple
-                ? // eslint-disable-next-line @typescript-eslint/no-unsafe-return
-                    `Multiple records found. ${result.records.map((item) => item[options.choiceField]).join(',')}`
+                ? `Multiple records found. ${result.records.map((item) => item[options.choiceField]).join(',')}`
                 : 'The query returned more than 1 record', exports.SingleRecordQueryErrors.MultipleRecords);
         }
         return result.records[0];
@@ -419,7 +418,6 @@ const getOptionsVersion = async (options) => {
 // jsforce does some interesting proxy loading on lib classes.
 // Setting this in the Connection.tooling getter will not work, it
 // must be set on the prototype.
-// eslint-disable-next-line @typescript-eslint/ban-ts-comment
 // @ts-ignore
 tooling_1.Tooling.prototype.autoFetchQuery = Connection.prototype.autoFetchQuery; // eslint-disable-line @typescript-eslint/unbound-method
 //# sourceMappingURL=connection.js.map

package/lib/org/org.js

@@ -952,14 +952,14 @@ class Org extends kit_1.AsyncOptionalCreatable {
      * Returns an org field. Returns undefined if the field is not set or invalid.
      */
     getField(key) {
-        /* eslint-disable @typescript-eslint/ban-ts-comment, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-assignment */
+        /* eslint-disable @typescript-eslint/ban-ts-comment, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-assignment */
         // @ts-ignore Legacy. We really shouldn't be doing this.
         const ownProp = this[key];
         if (ownProp && typeof ownProp !== 'function')
             return ownProp;
         // @ts-ignore
         return this.getConnection().getAuthInfoFields()[key];
-        /* eslint-enable @typescript-eslint/ban-ts-comment, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-assignment */
+        /* eslint-enable @typescript-eslint/ban-ts-comment, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-assignment */
     }
     /**
      * Returns a map of requested fields.
@@ -1071,7 +1071,6 @@ class Org extends kit_1.AsyncOptionalCreatable {
     /**
      * **Throws** *{@link SfError}{ name: 'NotSupportedError' }* Throws an unsupported error.
      */
-    // eslint-disable-next-line class-methods-use-this
     getDefaultOptions() {
         throw new sfError_1.SfError('Not Supported', 'NotSupportedError');
     }
@@ -1130,7 +1129,6 @@ class Org extends kit_1.AsyncOptionalCreatable {
             throw messages.createError('SandboxProcessNotFoundBySandboxName', [sandboxNameIn]);
         }
     }
-    // eslint-disable-next-line class-methods-use-this
     async queryProduction(org, field, value) {
         return org.connection.singleRecordQuery(`SELECT SandboxInfoId FROM SandboxProcess WHERE ${field} ='${value}' AND Status NOT IN ('D', 'E')`, { tooling: true });
     }

package/lib/org/scratchOrgInfoGenerator.js

@@ -191,7 +191,6 @@ exports.generateScratchOrgInfo = generateScratchOrgInfo;
 const getScratchOrgInfoPayload = async (options) => {
     let warnings = [];
     // Merge after all validations complete
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
     const scratchOrgInfoPayload = {
         ...(options.definitionfile ? await parseDefinitionFile(options.definitionfile) : {}),
         ...(options.definitionjson

package/lib/org/user.js

@@ -421,7 +421,6 @@ class User extends kit_1.AsyncCreatable {
     // eslint-disable-next-line class-methods-use-this
     async rawRequest(conn, options) {
         return new Promise((resolve, reject) => {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             const httpApi = new http_api_1.HttpApi(conn, options);
             httpApi.on('response', (response) => resolve(response));
             httpApi.request(options).catch(reject);

package/lib/sfProject.js

@@ -672,22 +672,17 @@ class SfProject {
             // Add fields in sfdx-config.json
             Object.assign(config, configAggregator.getConfig());
             // we don't have a login url yet, so use instanceUrl from config or default
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
             if (!config.sfdcLoginUrl) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
                 config.sfdcLoginUrl = configAggregator.getConfig()['org-instance-url'] ?? sfdcUrl_1.SfdcUrl.PRODUCTION;
             }
             // LEGACY - Allow override of sfdcLoginUrl via env var FORCE_SFDC_LOGIN_URL
             if (process.env.FORCE_SFDC_LOGIN_URL) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
                 config.sfdcLoginUrl = process.env.FORCE_SFDC_LOGIN_URL;
             }
             // Allow override of signupTargetLoginUrl via env var SFDX_SCRATCH_ORG_CREATION_LOGIN_URL
             if (process.env.SFDX_SCRATCH_ORG_CREATION_LOGIN_URL) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
                 config.signupTargetLoginUrl = process.env.SFDX_SCRATCH_ORG_CREATION_LOGIN_URL;
             }
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
             const loginUrl = config.sfdcLoginUrl;
             if (loginUrl) {
                 if (!sfdcUrl_1.SfdcUrl.isValidUrl(loginUrl) ||
@@ -695,7 +690,6 @@ class SfProject {
                     throw messages.createError('invalidProjectLoginUrl', [loginUrl]);
                 }
             }
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
             const signupUrl = config.signupTargetLoginUrl;
             if (signupUrl) {
                 if (!sfdcUrl_1.SfdcUrl.isValidUrl(signupUrl) ||

package/lib/stateAggregator/accessors/aliasAccessor.js

@@ -158,7 +158,7 @@ class AliasAccessor extends kit_1.AsyncOptionalCreatable {
                 await fs_1.fs.promises.mkdir((0, node_path_1.dirname)(this.fileLocation), { recursive: true });
                 this.aliasStore = new Map();
                 await fs_1.fs.promises.writeFile(this.fileLocation, aliasStoreToRawFileContents(this.aliasStore));
-                return lockResponse ? await lockResponse.unlock() : undefined;
+                return lockResponse ? lockResponse.unlock() : undefined;
             }
             if (lockResponse) {
                 await lockResponse.unlock();

package/lib/status/streamingClient.js

@@ -177,7 +177,6 @@ class StreamingClient extends kit_1.AsyncOptionalCreatable {
             outgoing: (message, callback) => {
                 if (message.channel === '/meta/subscribe') {
                     if (!message.ext) {
-                        // eslint-disable-next-line no-param-reassign
                         message.ext = {};
                     }
                     const replayFromMap = {};
@@ -311,7 +310,7 @@ class StreamingClient extends kit_1.AsyncOptionalCreatable {
             // @ts-ignore
             // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, no-underscore-dangle
             const dispatcher = this.cometClient._dispatcher;
-            // eslint-disable-next-line @typescript-eslint/restrict-template-expressions, @typescript-eslint/no-unsafe-member-access
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
             this.log(`dispatcher.clientId: ${dispatcher.clientId}`);
             // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
             if (!dispatcher.clientId) {

package/lib/testSetup.js

@@ -1,4 +1,24 @@
 "use strict";
+/*
+ * Copyright 2026, Salesforce, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// mutate ALL the THINGS!
+/// <reference types="mocha" />
+/* eslint-disable @typescript-eslint/ban-ts-comment */
+/* eslint-disable class-methods-use-this */
+/* eslint-disable @typescript-eslint/no-unsafe-assignment */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -26,27 +46,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MockTestSandboxData = exports.MockTestOrgData = exports.StreamingMockCometClient = exports.StreamingMockCometSubscription = exports.StreamingMockSubscriptionCall = exports.unexpectedResult = exports.restoreContext = exports.stubContext = exports.instantiateContext = exports.TestContext = exports.SecureBuffer = exports.uniqid = void 0;
 exports.shouldThrow = shouldThrow;
 exports.shouldThrowSync = shouldThrowSync;
-/*
- * Copyright 2026, Salesforce, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/* eslint-disable no-param-reassign */ // mutate ALL the THINGS!
-/* eslint-disable @typescript-eslint/ban-ts-comment */
-/* eslint-disable class-methods-use-this */
-/* eslint-disable @typescript-eslint/no-unsafe-assignment */
-/* eslint-disable @typescript-eslint/no-unsafe-member-access */
-/* eslint-disable @typescript-eslint/no-unsafe-call */
 const node_events_1 = require("node:events");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
@@ -348,7 +347,7 @@ const requireSinon = (sinon) => {
     if (sinon)
         return sinon;
     try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires, import/no-extraneous-dependencies
+        // eslint-disable-next-line import/no-extraneous-dependencies
         const newSinon = require('sinon');
         return newSinon;
     }
@@ -538,7 +537,6 @@ const restoreContext = (testContext) => {
     // Restore the default value for this setting on restore.
     global_1.Global.SFDX_INTEROPERABILITY = true;
     testContext.SANDBOX.restore();
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-return
     Object.values(testContext.SANDBOXES).forEach((theSandbox) => theSandbox.restore());
     testContext.configStubs = {};
     // Give each test run a clean StateAggregator
@@ -688,12 +686,12 @@ class StreamingMockCometClient extends streamingClient_1.CometClient {
     /**
      * Fake addExtension. Does nothing.
      */
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars,@typescript-eslint/no-empty-function
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     addExtension(extension) { }
     /**
      * Fake disable. Does nothing.
      */
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars,@typescript-eslint/no-empty-function
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     disable(label) { }
     /**
      * Fake handshake that invoke callback after the setTimeout event phase.
@@ -708,7 +706,7 @@ class StreamingMockCometClient extends streamingClient_1.CometClient {
     /**
      * Fake setHeader. Does nothing,
      */
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars,@typescript-eslint/no-empty-function
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setHeader(name, value) { }
     /**
      * Fake subscription that completed after the setTimout event phase.

package/lib/util/cache.js

@@ -17,12 +17,10 @@ exports.Cache = void 0;
  * limitations under the License.
  */
 class Cache extends Map {
-    /* eslint-disable @typescript-eslint/explicit-member-accessibility */
     static #instance;
     static #enabled = true;
     #hits;
     #lookups;
-    /* eslint-enable @typescript-eslint/explicit-member-accessibility */
     constructor() {
         super();
         this.#hits = 0;

package/lib/util/directoryWriter.js

@@ -61,7 +61,6 @@ class DirectoryWriter {
         throw new Error('Not implemented');
     }
     async addToStore(contents, targetPath) {
-        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
         const destPath = path.join(this.rootDestination, targetPath);
         fs_1.fs.mkdirSync(path.dirname(destPath), { recursive: true });
         if (contents instanceof node_stream_1.Readable) {

package/lib/util/mapKeys.js

@@ -30,14 +30,9 @@ const ts_types_1 = require("@salesforce/ts-types");
  * @param deep - {boolean} Whether to do a deep object key conversion
  * @return {Object} - the object with the converted keys
  */
-function mapKeys(
-// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/explicit-module-boundary-types
-obj, converter, deep) {
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+function mapKeys(obj, converter, deep) {
     const target = Object.assign({}, obj);
-    return Object.fromEntries(
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-    Object.entries(target).map(([key, value]) => {
+    return Object.fromEntries(Object.entries(target).map(([key, value]) => {
         const k = converter.call(null, key);
         if (deep) {
             let v = value;

package/lib/webOAuthServer.js

@@ -15,7 +15,6 @@
  * limitations under the License.
  */
 /* eslint-disable class-methods-use-this */
-/* eslint-disable @typescript-eslint/no-unsafe-member-access */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -273,7 +272,6 @@ class WebOAuthServer extends kit_1.AsyncCreatable {
                     this.logger.debug(`processing request for uri: ${url.pathname ?? 'null'}`);
                     if (request.method === 'GET') {
                         if (url.pathname?.startsWith('/OauthRedirect') && url.query) {
-                            // eslint-disable-next-line no-param-reassign
                             request.query = (0, node_querystring_1.parse)(url.query);
                             if (request.query.error) {
                                 const errorName = typeof request.query.error_description === 'string'
@@ -464,9 +462,7 @@ class WebServer extends kit_1.AsyncCreatable {
      * @param response the response to write the error to.
      */
     sendError(status, message, response) {
-        // eslint-disable-next-line no-param-reassign
         response.statusMessage = message;
-        // eslint-disable-next-line no-param-reassign
         response.statusCode = status;
         response.end();
     }
@@ -527,7 +523,6 @@ class WebServer extends kit_1.AsyncCreatable {
         // We don't validate the origin here because:
         // 1. The default login URL (login.salesforce.com) will not match after a redirect or if user choose a custom domain in login.
         // 2. There's no fixed list of auth URLs we could check against.
-        // eslint-disable-next-line no-param-reassign
         response.statusCode = 204; // No Content response
         response.setHeader('Access-Control-Allow-Methods', 'GET');
         response.setHeader('Access-Control-Request-Headers', 'GET');
@@ -578,7 +573,6 @@ class WebServer extends kit_1.AsyncCreatable {
             });
             // An error means that no existing connection exists, which is what we want
             socket.on('error', () => {
-                // eslint-disable-next-line no-console
                 socket.destroy();
                 resolve(this.port);
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/core",
-  "version": "9.1.4",
+  "version": "9.1.6",
   "description": "Core libraries to interact with SFDX projects, orgs, and APIs.",
   "main": "lib/index",
   "types": "lib/index.d.ts",
@@ -83,15 +83,21 @@
     "zod": "^4.1.12"
   },
   "devDependencies": {
-    "@salesforce/dev-scripts": "^11.0.4",
+    "@salesforce/dev-scripts": "^13.0.2",
     "@salesforce/ts-sinon": "^1.4.31",
     "@types/benchmark": "^2.1.5",
+    "@types/chai": "^4.3.17",
     "@types/fast-levenshtein": "^0.0.4",
     "@types/jsonwebtoken": "9.0.10",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^18",
     "@types/proper-lockfile": "^4.1.4",
     "@types/semver": "^7.7.1",
+    "@types/sinon": "^10.0.20",
     "benchmark": "^2.1.4",
     "esbuild": "^0.28.0",
+    "eslint": "^10.4.0",
+    "eslint-config-salesforce-typescript": "^6.0.0",
     "mocha": "^11.7.5",
     "ts-node": "^10.9.2",
     "ts-patch": "^3.3.0",
@@ -150,6 +156,7 @@
         "src/**/*.ts",
         "test/**/*.ts",
         "messages/**",
+        "**/eslint.config.*",
         "**/.eslint*",
         "**/tsconfig.json"
       ],