[sasjs-dev]

The devDependency is what the commands run against in this tree, and every other devDependency here is pinned exactly (save-exact matches), so lint goes 4.4.0 -> 4.6.1 as an exact pin - the release whose quoted-string scanning and 3-character name floor change what sasjs lint reports.

The peer range stays ^4.4.0: raising it fails to resolve for every consumer still on 4.4.x or 4.5.x (npm 7+ reports ERESOLVE below the floor rather than warning), and the CLI uses no API that 4.6.1 added - the difference is what lint reports, which belongs in lint's release note. A range states compatibility, an exact value states what was tested, so the two carry different versions on purpose.

devDependencies  @sasjs/lint  4.6.1     (exact, matches the block)
peerDependencies @sasjs/lint  ^4.4.0    (unchanged)

Lockfile resolves one copy at 4.6.1; tsc --noEmit clean; npx jest src/commands/lint 13/13.

The Audit the release toolchain failure on the previous head is unrelated - three undici advisories published since the last green run, reproduced on main at 62fd077 and fixed in #1504.

[sasjs-dev]

Reviewed the full diff: package.json and package-lock.json raise @sasjs/lint from ^4.4.0 to ^4.6.1 in devDependencies and peerDependencies; no source changes. CI status is pending at this head, so this is a diff-only review.

• package.json:127 - raising the peerDependencies floor to ^4.6.1 breaks every consumer still on lint 4.4.x/4.5.x: npm 7+ fails to resolve the tree instead of warning the way it does below the floor. That is a breaking change to the peer contract, which fix(deps) understates. Note it in the release notes, or leave the peer floor at ^4.4.0 if the code does not actually require the newer API.
• package.json:97 - the entry keeps its caret range while the surrounding dependencies are pinned exactly, and .npmrc sets save-exact. Pin @sasjs/lint to 4.6.1 so installs stay reproducible and a future 4.x cannot drift in under the released floor.

2 findings above for review.

[sasjs-dev]

Both taken, and the audit failure was not this diff.

Peer floor - reverted to ^4.4.0. You are right that raising it is a breaking contract change: npm 7+ fails to resolve below the floor instead of warning, so every consumer on 4.4.x or 4.5.x would stop installing, and the CLI uses no API 4.6.1 added. The difference is what lint reports, which is lint's release note to make.

devDependency - now exactly 4.6.1. Every other devDependency in the file is pinned exactly, and .npmrc sets save-exact, so the range was mine to begin with and wrong. The two blocks now carry different versions deliberately: a range states compatibility, an exact value states what the tests run against.

devDependencies  @sasjs/lint  4.6.1
peerDependencies @sasjs/lint  ^4.4.0

Title changed to match what the diff now is (fix(deps): run the cli tests against @sasjs/lint 4.6.1). Lockfile resolves one copy at 4.6.1, tsc --noEmit clean, 13/13 lint-command specs.

The red Audit the release toolchain step is not from this branch. It reproduces on main at 62fd077 in a clean worktree: three undici advisories (TLS option drop, TLS 1.2 renegotiation, WebSocket PONG buffering) on the copy the script already documents twice - undici 6.29.0 bundled inside npm 11.21.1. Measured today that nothing here moves it: a bundled dependency is not a resolvable node, so overrides cannot reach it, and npm 12.2.1 also publishes 6.29.0 in its own tarball. Fixed in #1504, which adds the three entries with their own arguments; it should be merged first so this one's CI is clean.

[sasjs-dev]

Reviewed the full base...head diff - a devDependency bump (@sasjs/lint ^4.4.0 -> 4.6.1) with the matching package-lock.json entry. The range is now pinned, which is the direction the hardening rule wants; no source changes ride along.

• CI reports no check contexts yet at this head (pending). Confirm the lint-version bump is green before merging, since the change exists only to move the test toolchain.

No blocking issues.

[github-actions]

Coverage report

Total coverage

Status	Category	Percentage	Covered / Total
🟡	Statements	79.06%	4648/5879
🟡	Branches	67.88%	2029/2989
🟡	Functions	78.28%	908/1160
🟢	Lines	86.37%	11071/12818

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Report generated by 🧪jest coverage report action from c474074