feat: update development dependencies

[0xAxiom]

This PR updates several development dependencies to their latest compatible versions:

What:

• Updated @commitlint packages to v20.5.0
• Updated @types/node to v25.5.0 in CLI and core workspaces
• Installed missing dependencies for claw-pipeline/base-wallet-xray subdirectory
• Maintained compatibility with existing ESLint configurations (ESLint v9 to avoid Next.js conflicts)

Why:

• Keeps development tooling current with latest security patches
• Improves type safety with newer @types/node
• Fixes missing dependencies in pipeline subdirectories
• Maintains project stability by avoiding breaking changes

Tested:

• ✅ All tests pass (npm run ci)
• ✅ Linting works properly (53 warnings, 0 errors)
• ✅ Type checking passes for all workspaces
• ✅ Formatting validation passes
• ✅ No new security vulnerabilities introduced

The changes improve development tooling while maintaining full backward compatibility.

In general, to fix insecure temporary file issues you should avoid constructing paths under os.tmpdir() manually. Instead, use a library or API that creates a unique, securely permissioned temporary directory or file (for Node.js, commonly the tmp package), and then create your test files inside that directory.

For this snippet, the best minimal fix is to replace the manual tmpdir() + timestamp logic in setupTestDir() with a call to tmp.dirSync() from the tmp package. This returns a securely created, unique temporary directory path. We then keep the rest of the test logic unchanged: the tests still get a directory path in testDir and still create pipeline.json within that directory. Concretely:

• Add an import for tmp at the top of core/src/__tests__/config-loader.test.js.
• Change setupTestDir() so that it calls tmp.dirSync({ unsafeCleanup: true }).name instead of using join(tmpdir(), ...) and mkdirSync. This preserves the external behavior (tests get an empty directory path), but uses a secure temp directory mechanism.
• The cleanupTestDir() function can remain as-is; it will remove whatever directory path tmp.dirSync() created.

All other code paths (including the use of configPath and writeFileSync) can remain unchanged.

---

In general, to fix insecure temp-file/directory issues, avoid manually constructing paths under os.tmpdir() with predictable names. Instead, delegate to a secure library (such as tmp) that creates unique, non-guessable directories or files with safe permissions and guarantees they don’t already exist.

For this specific file, the cleanest fix is to modify setupTestDir to create a secure temporary directory using the tmp package rather than join(tmpdir(), ...) and mkdirSync. We can import tmp at the top of the test file and call tmp.dirSync({ unsafeCleanup: true }) to get a unique temp directory path. We then store the directory name (tmp.dirSync().name) into testDir and return it. The rest of the tests can remain unchanged because they already treat setupTestDir() as a black box that returns a directory path. Cleanup can continue to use rmSync(testDir, { recursive: true, force: true }); unsafeCleanup is mostly for tmp’s own cleanup helpers, so we don’t need to use them if we prefer to keep the existing cleanupTestDir logic.

Concretely:

• Add import tmp from 'tmp'; near the top of core/src/__tests__/config-loader.test.js.
• Change setupTestDir so that instead of computing testDir = join(tmpdir(), ...) and calling mkdirSync, it calls tmp.dirSync({ unsafeCleanup: true }), assigns testDir = tmpDir.name, and returns testDir.
• Leave cleanupTestDir and all test logic intact.

In general, the fix is to avoid creating predictable paths directly under os.tmpdir() and instead use a secure temporary directory creation mechanism that ensures uniqueness and appropriate permissions. In Node.js, the tmp package provides dirSync() which securely creates a new temporary directory with restrictive permissions and a non-predictable name; we can then create our test files inside that directory as before.

For this specific file, the simplest, least intrusive change is:

• Import tmp at the top of core/src/__tests__/config-loader.test.js.
• Rewrite setupTestDir() so that it calls tmp.dirSync({ unsafeCleanup: true }) instead of manually composing a directory path with tmpdir() and mkdirSync. Store the returned directory name in testDir (as now) and return it.
• Keep cleanupTestDir() as-is: it will still remove testDir if set; even if tmp already cleans up, double cleanup with rmSync(..., { force: true }) is safe in tests and preserves existing behavior.

No other test logic (e.g., how configPath is constructed or used) needs to change because all tests already use setupTestDir() to obtain the directory in which they create config files.

Concretely:

• Add import tmp from 'tmp'; near the existing imports.
• Replace the body of setupTestDir() so that it uses tmp.dirSync() and assigns testDir = tmp.dirSync({ unsafeCleanup: true }).name;.

General fix: avoid manually constructing paths under os.tmpdir() using timestamps or predictable names. Instead, delegate temp directory creation to a library like tmp, which will (a) create the directory atomically, (b) ensure it does not already exist, and (c) use restrictive permissions by default. Then, base all test file paths on the secure directory path returned by that library.

Best fix here: change setupTestDir so it uses tmp.dirSync (from the tmp package) to create a unique temporary directory, rather than join(tmpdir(), ...) plus mkdirSync. Keep the rest of the test logic unchanged: it should still return a directory path string that is later passed to join(dir, 'validation.json'), etc. The cleanupTestDir function can continue to use rmSync on testDir, since tmp.dirSync will create a real directory path on disk. We also need to import tmp at the top of the file.

Concretely:

• In core/src/__tests__/config-loader.test.js:
  • Add import tmp from 'tmp'; alongside the other imports.
  • Update setupTestDir:
    • Remove use of tmpdir(), join, and mkdirSync.
    • Replace with testDir = tmp.dirSync({ unsafeCleanup: true }).name; and return that.
  • Leave cleanupTestDir unchanged; it will still remove the created directory tree.

No other tests or functions need modification.

In general, to fix insecure temp file/directory creation you should avoid manually constructing paths under os.tmpdir() and instead use a library (such as tmp) that atomically creates unique, non‑guessable directories or files with appropriate permissions, returning a path you can safely use.

For this specific test file, the issue comes from setupTestDir:

function setupTestDir() {
  testDir = join(tmpdir(), `appfactory-test-${Date.now()}`);
  mkdirSync(testDir, { recursive: true });
  return testDir;
}

We should replace this with a call to tmp.dirSync so the directory is securely and uniquely created by the library, while preserving existing behavior: returning a path in testDir that the tests then use, and cleaning it up with rmSync at the end. The concrete steps:

• Add an import for the tmp package at the top of core/src/__tests__/config-loader.test.js.
• Update setupTestDir to call tmp.dirSync({ unsafeCleanup: true, prefix: 'appfactory-test-' }), store the resulting directory path in testDir, and return it.
  • unsafeCleanup: true ensures nested files/dirs are also removed if we ever decide to use the cleanup callback; in our current code we still call rmSync, which is fine since it’s recursive and forced.
  • Using a prefix maintains similar naming for readability while letting tmp handle uniqueness and security.
• Remove the direct use of tmpdir() and mkdirSync inside setupTestDir; other tests can continue to call setupTestDir() unchanged.

No other logic in the tests has to change; they already rely only on the directory path setupTestDir returns.