[ivankristianto]

Summary

Every npm package is on its latest major, except yargs (held at 17) and eslint-plugin-jsdoc (held at 63, because 64+ needs Node 22.22). The supported Node floor moves from 10 to 22.18, which is what Babel 8 requires. CI now runs on exactly 22.18.0 and on 26, instead of 12. ESLint moves to a flat config: @10up/eslint-config blocked both Babel 8 and any supported ESLint, so it's replaced. Prettier options are kept exactly, so formatting doesn't change.

Closes: no linked issue. Supersedes #30.

Type of change

• Feature
• Bug fix
• Refactor (no behavior change)
• Dependency or infrastructure update
• Docs

Changes

Commits, in order. Each one passes npm ci, npm test, npm run lint and the --help walk on Node 22.18.0 by itself, checked commit by commit in a clean worktree.

1. chore(lint): move to eslint 10 flat config: drops @10up/eslint-config (this also fixes npm ci on main) and includes the small code changes the new rules asked for. It touches only lint packages in the lockfile.
2. chore(deps): update runtime dependencies
3. chore(deps): update dev tooling: Babel 8 and the test stack.
4. chore(ci): move node floor to 22.18, test on 22.18.0 and 26: engines, README, both workflows (npm ci, actions v7). CI pins the exact floor because a bare 22 resolves to the newest 22.x and would hide packages that need a later minor.
5. chore(package): ship only lib, bin and docs: a files whitelist replaces .npmignore.
6. refactor(zones): share the settings subcommand handler: the four zones settings commands had identical bodies. That body now lives in src/utils/zone-setting-command.js, with a unit test for the --value set path.
7. docs: add CLAUDE.md and maintenance skill: agent docs plus the /maintenance skill that produced this PR.
8. docs(github): add pull request template
9. chore(deps): refresh lockfile within ranges: moves transitive dependencies to the newest versions their ranges allow, and the lockfile to v3. It's its own commit so it can be reverted separately.

This history was rebuilt after code review. The first version declared a 22.13 floor that Babel 8 and jsdoc 65 didn't meet, and it mixed in-range bumps into the lint commit.

Node and CI

Component	From	To
Supported Node (engines, README)	10+ (README only)	>=22.18
CI build-and-test.yml	Node 12, npm install	matrix 22.18.0, 26, npm ci
CI npm-publish.yml	Node 12, npm install	Node 26, npm ci
actions/checkout	v2	v7
actions/setup-node	v1	v7
Babel output target	ES5 + regenerator	Node 22.18 (native async/await)
Package contents	.npmignore deny-list	files: lib, bin, HOWTO.md, CHANGELOG.md (+ README, LICENSE)

Runtime dependencies

Package	From	To	Major	Notes
chalk	4.1.0	6.0.1	yes	ESM-only, loads via require(esm). releases
ora	4.1.1	10.0.0	yes	ESM-only. releases
inquirer	7.3.3	14.2.5	yes	ESM-only. prompt() API unchanged for input/confirm. releases
node-fetch	2.6.7	3.3.2	yes	ESM-only. upgrade guide
fs-extra	9.1.0	11.4.1	yes	changelog
form-data	3.0.0	4.0.6	yes	Clears the critical advisory. releases
yargs	15.4.1	17.7.3	yes	See Held back. changelog
@babel/runtime	7.17.2	8.1.0	yes	Matches Babel 8. migration
lodash	4.17.21	4.18.1	no
cli-table3	0.6.0	0.6.5	no

Already current: csv-writer.

Dev dependencies

Package	From	To	Major	Notes
@babel/cli	7.17.0	8.1.0	yes	Needs Node ^22.18. migration
@babel/core	7.17.2	8.1.0	yes	migration
@babel/preset-env	7.16.11	8.0.7	yes	migration
@babel/plugin-transform-runtime	7.12.10	8.0.6	yes	migration
@babel/register	7.12.10	8.0.6	yes	migration
eslint	8.9.0	10.14.0	yes	Flat config. migrate to 9, migrate to 10
@eslint/js	(new)	10.0.1	n/a	Replaces airbnb-base as the base rule set
globals	(new)	17.14.0	n/a	Node and mocha globals for the flat config
eslint-plugin-jsdoc	37.9.1	63.3.3	yes	Same jsdoc rules as before. See Held back. releases
eslint-plugin-prettier	3.3.1	5.5.7	yes	releases
eslint-config-prettier	6.15.0	10.1.8	yes	releases
prettier	2.4.1	3.9.10	yes	Options pinned in eslint.config.js, so no format churn. 3.0 notes
mocha	9.2.0	12.0.3	yes	Fixes npm test on Node 26. changelog
chai	4.2.0	6.3.0	yes	ESM-only. releases
sinon	9.2.4	22.1.0	yes	changelog
rimraf	3.0.2	6.1.4	yes	changelog
cross-env	7.0.3	10.1.0	yes	releases
@10up/eslint-config	2.4.1	removed	n/a	Peers on @babel/core 7 and airbnb (ESLint 8 only), even in 5.0.0
eslint-config-airbnb, eslint-config-airbnb-base, eslint-plugin-import, eslint-plugin-jsx-a11y, eslint-plugin-react, eslint-plugin-react-hooks		removed	n/a	Came in with the 10up config
@babel/eslint-parser, babel-eslint	7.17.0, 10.1.0	removed	n/a	Default parser handles the code; babel-eslint was deprecated
core-js	3.21.0	removed	n/a	Only used by useBuiltIns: entry, which had no entry import

Already current: temp. istanbul is unchanged; see Risk.

Breaking changes reviewed

Package	Change	Impact on this repo	Fix
chalk, ora, inquirer, node-fetch, chai	ESM-only	Babel emits require()	Loads through require(esm) (Node 22.12+), which the 22.18 floor covers. Every command was run on 22.18.0 and 26.13
Babel 8	modules: "auto" no longer means CommonJS; useBuiltIns/corejs removed; default targets changed; needs Node ^22.18	Output would have been ESM	.babelrc sets modules: "commonjs" and top-level targets.node: "22.18"; the floor moves to 22.18
yargs 16/17	Async handlers return a promise; dropped Node 10	None seen	Command output byte-identical to main
ESLint 10	no-useless-assignment in recommended	4 zone settings commands declared requestArgs outside the branch that used it	Fixed in the lint commit; the review follow-up then moved that body into the shared handler
node-fetch 3 + form-data 4	Body and header handling rewritten	dns import posts multipart	Ran requestWithFormData against a local HTTP server on main and on this branch: same content type, auth header and body
inquirer 14	Rebuilt on @inquirer/core	config setup/add/delete/reset	Drove config setup and config add with expect: validation fires and the written config matches main

Held back

Package	Stayed on	Latest	Reason	Unblocked by
yargs	17.7.3	18.2.0	18 removes the singleton (yargs.argv), which Config.getAuthToken and Cloudflare.convert*ToId read, and goes ESM-first	Passing useToken into the class layer instead of reading yargs.argv
eslint-plugin-jsdoc	63.3.3	65.4.3	64+ needs Node ^22.22.2, above the 22.18 floor	Floor reaching 22.22 or 24

Verification

Check	Node 22.18.0 (floor)	Node 26.13.0
npm ci (no legacy peer deps)	pass	pass
npm test	pass (16)	pass (16)
npm run lint	pass (0 errors, 8 jsdoc warnings, same as main)	pass (same)
npm audit --omit=dev	0 (was 6: 1 critical, 2 high)	0
Lockfile engines.node vs 22.18.0	every package accepts it (87 rejected 22.13)	n/a
npm pack --dry-run contents	lib/, bin/cf, README, LICENSE, CHANGELOG, HOWTO only	same
cf <cmd> --help for every command	pass	pass
cf config list against fixture	pass	pass
Live read-only smoke tests	pass, except the 3 pre-existing failures below	same
Output vs main (7 read-only commands plus 7 zones settings variants)	byte-identical	byte-identical
Every commit on its own: npm ci, npm test, npm run lint, --help walk	pass (9/9)	n/a

Superseded

• Bump braces from 3.0.2 to 3.0.3 #30 (braces 3.0.3): braces is no longer in the dependency tree after mocha 12.
• https://github.com/ivankristianto/cloudflare-cli-node/tree/upgrade-node-20: earlier attempt that switched to @wordpress/eslint-plugin and reformatted 70 files. This PR keeps the formatting instead.

Pre-existing failures on main

• npm ci failed with ERESOLVE (@10up/eslint-config 2.4 wanted airbnb 19, the repo pinned 18). Fixed here.
• npm test crashed on Node 26 (mocha 9). Fixed here.
• cf firewall list and cf filters list return firewallrules.api.deprecated / filters.api.deprecated. Cloudflare retired those APIs in favour of Rulesets, so both commands are broken for users regardless of this PR.
• cf user get returns "Unauthorized" with the read-only test token (token scope, same on main).
• npm run cover references babel-core/register, which isn't installed. Not touched.

How to test

1. On Node 22.18.0 and on Node 26: npm ci && npm test && npm run lint
2. for c in accounts config dns filters firewall ips rules user zones "zones settings"; do node bin/cf $c --help >/dev/null || echo "FAIL $c"; done (in zsh use ${=c})
3. With a token configured: PATH="$PWD/bin:$PATH" cf zones list, cf dns list <zone> and cf zones settings ssl <zone>. The second resolves the zone name through a child cf, so bin/ has to be first in PATH.

Risk and rollback

• Users on Node below 22.18 can't run the next release. npm will warn from engines, and the ESM-only packages fail to load below 22.12. CHANGELOG says so under [next].
• The published lib/ now targets Node 22.18 rather than ES5, and the package no longer ships repo dotfiles.
• zones settings commands now share one handler. Get output is byte-identical to main, and the unit test covers the set path. One small change: the spinner for ssl --value says "Updating Zone ssl setting" where it used to say "SSL".
• istanbul is unmaintained and the cover script is broken; replacing coverage tooling is left for later.
• ESLint 8 was EOL. The new rule set is lighter than airbnb (it's @eslint/js recommended plus the old jsdoc and Prettier rules), so some airbnb-only checks no longer run.
• Rollback: revert the merge. Nothing is published until a release is cut.

Checklist

• npm test passes
• npm run lint passes
• node bin/cf <command> --help loads for every command touched
• CHANGELOG.md updated under ## [next] for user-facing changes