build: bump @electron/lint-roller to ^4.0.0

[claude]

Requested by David Sanders · Slack thread

Description of Change

Before: @electron/lint-roller was pinned at ^3.3.0, and check-blog-links.yml invoked lint-roller-markdown-links with the --fetch-external-links flag.

After: @electron/lint-roller is ^4.0.0 (lockfile resolves to 4.0.0), and the --fetch-external-links flag, removed in 4.0.0, is dropped from the check-blog-links.yml invocation. No package.json scripts changed.

Notes

• 4.0.0 breaking changes that touch this repo:
  • lint-roller-markdown-links dropped --fetch-external-links and --check-redirects. Only --fetch-external-links was used here (.github/workflows/check-blog-links.yml). With it removed, that workflow now validates only internal/relative links and anchors in changed blog posts, not that external URLs resolve.
  • lint-roller-markdown-standard was removed; this repo never used it (markdown lints via markdownlint-cli2 extending @electron/lint-roller/configs/markdownlint.json and its custom rules, both unchanged).
  • Node floor is now ^22.17.0 || >=24.0.0. engines.node is 24, .nvmrc is 24.19.0, and every workflow uses .nvmrc or 24.19.0, so no CI change needed.
• Peer warning on install: oxlint is listed by your project with version 1.57.0, which doesn't satisfy what @electron/lint-roller requests (>=1.65.0). It is only relevant to the new lint-roller-markdown-oxlint bin, which this repo does not use. oxfmt ^0.42.0 already satisfies the >=0.20.0 peer.
• Tests: yarn lint passes (tsc, oxfmt --check, oxlint, markdownlint-cli2 on 140 files, 0 errors). The migrated lint-roller-markdown-links --ignore-path .markdownlintignore --allow-absolute-links --resource-root static invocation runs clean locally against recent blog posts; the old flag is rejected by 4.0.0 with a usage error.
• Lockfile delta: yarn.lock +53 / -1332 (the ESLint/standard dependency tree is gone).
• Open questions: should oxlint be bumped to ^1.65.0 to clear the peer warning, and does check-blog-links.yml need a replacement for external-link fetching?

Checklist

• I have reviewed and verified the changes

🤖 Generated with Claude Code

https://claude.ai/code/session_01MpGBviMFFyBDsWe7wfW3eV

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​electron/​lint-roller@​3.3.0 ⏵ 4.0.0	+9		+6	+8

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Recently published: npm @electron/lint-roller published yesterday Location: Package overview From: package.json → npm/@electron/lint-roller@4.0.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@electron/lint-roller@4.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cloudflare-workers-and-pages]

Deploying electron-website with    Cloudflare Pages

Latest commit:	99eb49d
Status:	✅  Deploy successful!
Preview URL:	https://10d2dde2.electron-website.pages.dev
Branch Preview URL:	https://lint-roller-4.electron-website.pages.dev

View logs