Merge upstream updates, bump dependencies, and refactor code and unit tests

[marcransome]

These changes incorporate upstream updates, dependency version bumps, and refactoring across the codebase and unit tests to improve maintainability and mitigate vulnerabilities. This includes the following changes:

• Updated Dockerfile to use node:25-alpine base image.
• Mitigated CVE-2026-24842 and CVE-2026-25547 by updating npm.
• Removed coveralls due to dependency on request¹ package.
• Replaced request¹ and request-promise¹ with got version ^11.8.6; this is the last known version to support CommonJS at this time, newer versions are ESM-only.
• Refactored bin/out.js, replacing request-promise related logic with equivalent logic using got promises.
• Replaced js-combinatorics with inline function combinations() in unit test file; js-combinatorics uses heuristics that incorrectly treat the array of strings named required as a scalar leading to BigInt conversion failures.
• Wrapped stdin related statements in a cli_mode_only() function in bin/out.js to avoid creating TTY handles when running in a test environment, which would otherwise remain open and lead to TTYWRAP failures when running npm test.
• Added ESLint config file (eslint.config.cjs) and replaced deprecated --ignore-path flag from pretest script with explicit coverage/** ignore rule.
• Fixed logic to determine if a matching webhook exists (as per Match existing hook without payload secret homedepot/github-webhook-resource#55).
• Set Content-Type header for webhook requests to application/x-www-form-urlencoded (i.e. parameter payload_content_type defaults to form); this is a requirement of ci-webhook-trigger.
• Updated GitHub Actions CI workflow (see Node.js CI workflow).
• Added Dependabot configuration for grouped version/security updates to ease future maintenance.
• Added CODEOWNERS configuration and updated branch protection rules to require reviews from designated code owners.
• Added strict set of overrides to package.json to mitigate CVE-2026-26996

Resolves: DVOP-4179.

Footnotes

1. request and request-promise are deprecated and exhibit known vulnerabilities; see https://github.com/request/request/issues/3142. ↩ ↩² ↩³

[ch-code-analysis]

Image build success

[ch-code-analysis]

Image build success

[ch-code-analysis]

Image build success