feat!: require jsdoc 4.x

[KoenDG]

This PR #19 seems abandoned?

It was stated publish.js had too many changes.

I went over these changes, they were all whitespace changes, save the 1 dependency change. I reverted all these changes, except the change to the jsdoc/taffydb import. Effectively that becomes a drop-in replacement.

Apart from that, the jsdoc related packages had received an update in the mean time, so I upgraded those versions.

Disclaimer: I have no knowledge of the impact of these changes, this PR is a fully copy of the previous PR, minus the whitespace changes that made publish.js too big to check.

Hoping this can get merged to then have a look at other outdated dependencies, that potentially carry vulnerabilities with them.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: KoenDG / name: Koen De Groote (0d4dc6e)

[KoenDG]

@JoshuaKGoldberg Sorry to ping directly. Saw your name on the previous ticket, only reference I have. Should I ping someone else about this?

Is this still something that's desired?

I'm just doing it because there's a lot of CVEs on this old code and just updating this dependency makes most of them go away.

[JoshuaKGoldberg]

👋 thanks for sending this @KoenDG, and thanks for the ping! I'd neglected to subscribe to this repository and so missed your PR.

I have no knowledge of the impact of these changes

Is there a reason you want to push this work forward? For mochajs.org we're planning on migrating over to mochajs.org/next, eventually deprecating this repository. mochajs/mocha#5309

[KoenDG]

I wound up here while looking for the source of certain vulnerabilities, and looking to see if I could update the dependencies to fix that.

The project seems to be a direct dependency of mocha itself.

Running npm ci on this project alone prints the following:

32 vulnerabilities (6 low, 5 moderate, 19 high, 2 critical)

So I thought I would see what I can do to fix that.

It's likely these vulnerabilities aren't exposed in such a way they can impact a live project, but still, it's not a good look to have critical and high level vulnerabilities in one's dependencies.