.github/workflows/eslint.yml:36

• This workflow uses npm for dependency installation, but the project consistently uses Bun as its package manager across all other workflows. The test.yml and npm-publish.yml workflows all use oven-sh/setup-bun@v2 with bun-version: '1.3.7' followed by bun install --frozen-lockfile. This inconsistency could lead to different dependency resolution or installation issues.

The workflow should be updated to:

1. Set up Bun using oven-sh/setup-bun@v2 with bun-version: '1.3.7'
2. Install dependencies with bun install --frozen-lockfile
3. Install the SARIF formatter with bun add -d @microsoft/eslint-formatter-sarif@3.1.0

      - name: Install dependencies
        run: |
          npm ci
          npm install @microsoft/eslint-formatter-sarif@3.1.0

.github/workflows/eslint.yml:43

• The --ext flag is deprecated in ESLint v9 and is only supported by the legacy eslintrc configuration system. This project uses the new flat config system (eslint.config.js), which determines file patterns from the config file itself. The eslint.config.js file already specifies files: ['**/*.{ts,tsx,js,jsx}'], so the --ext flag is redundant and will cause a warning or error with ESLint v9.39.2 (as specified in package.json).

Remove the --ext .js,.jsx,.ts,.tsx argument from the ESLint command. The flat config already handles file matching.

          npx eslint . \
            --ext .js,.jsx,.ts,.tsx \

.github/workflows/eslint.yml:17

• The pull_request trigger only targets the "main" branch, but the codeql.yml workflow (which performs similar security scanning) targets both "main" and "development" branches. The push trigger correctly includes both branches on line 14. This inconsistency means that pull requests targeting the "development" branch won't run ESLint scanning, creating a gap in code quality checks.

Update line 17 to match the codeql.yml pattern: branches: [ "main", "development" ]

    branches: [ "main" ]