Cut runtime dependencies from 17 packages to 10

Remove fs-extra and debug from the runtime dependencies, and which from
the dev dependencies:

- fs-extra: 3 of its 7 call sites (existsSync, statSync) were plain
  node:fs re-exports; the rest map to fs.promises.mkdir/writeFile/readdir
  and JSON.parse(fs.readFileSync()). Drops fs-extra, graceful-fs,
  jsonfile and universalify.
- debug: replaced by a ~10 line local helper. util.debuglog cannot be
  used because it only reads NODE_DEBUG from the launch environment, so
  it would have broken the documented DEBUG=java-caller contract, which
  this helper keeps working unchanged. Drops debug and ms.
- which: used once, to find the java binary in a test, and its engines
  field (^22.22.2 || ^24.15.0 || >=26) excludes the Node 18/20 versions
  the CI matrix tests. Replaced by a findInPath test helper.
- Bump yauzl so it no longer pulls buffer-crc32.

Also fixes a few things found on the way:

- engines said node >=12 while njre@3 requires >=18 and every dev tool
  needs 18+, so consumers on Node 12-16 installed a broken tree.
- npm run lint was already broken on main: eslint 10 no longer hoists
  @eslint/js and globals, which eslint.config.js requires. They are now
  declared explicitly, and a Lint job runs npm run lint in CI so the
  script cannot silently rot again.
- Drop the @babel/core and uuid overrides, which matched no package in
  the tree.

Author: nvuillam

.github/workflows/test.yml

@@ -11,6 +11,24 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+      - name: Install dependencies
+        run: npm ci
+      - name: Run lint
+        run: npm run lint
+
   test:
     if: github.event_name != 'push' || github.ref_name == github.event.repository.default_branch
     strategy:

CLAUDE.md

@@ -50,10 +50,11 @@ Three modules in `lib/`, re-exported from `index.js`:
 - **Java-version resolution is cached on `globalThis.JAVA_CALLER_VERSIONS_CACHE`** to avoid repeated lookups across instances in one process. Tests reset this in `test/helpers/init.js`; if you add caching state, reset it there too.
 - **Platform branching** lives in `getPlatformBinPath()` (darwin = `Contents/Home/bin`) and several `os.platform() === "win32"` checks. Windows also handles arg quoting (`windowsVerbatimArguments`), `javaw` for windowless, and `windowsHide`. Any new behavior must be validated on win32/darwin/linux.
 - **`classPath`** accepts a string (split on `:`, converted to the OS delimiter) or a string array; resolved against `rootPath` unless `useAbsoluteClassPaths` is set.
+- **Runtime dependencies are deliberately minimal** (`njre` + `semver` only): prefer `node:` built-ins over adding a package. The `debug()` helper at the top of `java-caller.js` is a local ~10-line replacement for the `debug` package and keeps the documented `DEBUG=java-caller` contract — `util.debuglog` can't, since it only reads `NODE_DEBUG` from the launch environment.
 
 ## Testing notes
 
 - Tests are mocha + `node:assert`, with shared helpers in `test/helpers/common.js` (`checkStatus`, `checkStdOutIncludes`, etc.) and per-run init in `test/helpers/init.js` (loaded via the `mocha.require` config in `package.json`).
 - `test/java-install.test.js` exercises the real `njre` download/install path, which is why the mocha timeout is 5 minutes.
-- CI (`.github/workflows/test.yml`) runs the matrix Node 18/20/24 × Java 8/11/17/21/25 × ubuntu/macos/windows, plus a no-Java job (`Test - No Java`) that runs the suite in a container without a system JDK.
+- CI (`.github/workflows/test.yml`) runs the matrix Node 18/20/24 × Java 8/11/17/21/25 × ubuntu/macos/windows, plus a no-Java job (`Test - No Java`) that runs the suite in a container without a system JDK, plus a `Lint` job running `npm run lint`.
 - macOS defaults `minimumJavaVersion` to 11 (no Java 8 there); keep that branch intact.

lib/cli.js

@@ -1,6 +1,6 @@
 #! /usr/bin/env node
 const { JavaCaller } = require("./java-caller");
-const fse = require("fs-extra");
+const fs = require("fs");
 const path = require("path");
 
 class JavaCallerCli {
@@ -11,7 +11,7 @@ class JavaCallerCli {
     constructor(baseDir) {
         // Use user-defined JSON file to read configuration
         const configFile = path.resolve(`${baseDir}/java-caller-config.json`);
-        const options = fse.readJSONSync(configFile);
+        const options = JSON.parse(fs.readFileSync(configFile, "utf8"));
         // Default output is console with CLI
         if (options.output == null) {
             options.output = "console";

lib/java-caller.js

@@ -1,11 +1,25 @@
 #! /usr/bin/env node
-const debug = require("debug")("java-caller");
-const fse = require("fs-extra");
+const fs = require("fs");
 const os = require("os");
 const path = require("path");
+const util = require("util");
 const { spawn } = require("child_process");
 const semver = require("semver");
 
+// Traces are activated with DEBUG=java-caller, as before: util.debuglog is not usable here
+// because it only reads NODE_DEBUG from the environment the process was launched with.
+// Read at call time so DEBUG can be set after this module is loaded.
+const isDebugEnabled = () =>
+    (process.env.DEBUG || "").split(",").some((entry) => {
+        const namespace = entry.trim();
+        return namespace === "java-caller" || namespace === "*";
+    });
+const debug = (...args) => {
+    if (isDebugEnabled()) {
+        console.error(`java-caller ${util.format(...args)}`);
+    }
+};
+
 class JavaCaller {
     "use strict";
     minimumJavaVersion = os.platform() === "darwin" ? 11 : 8; // Mac starts at 11
@@ -334,15 +348,15 @@ class JavaCaller {
             console.log(`Installing Java ${javaTypeToInstall} ${javaVersionToInstall} in ${this.javaCallerSupportDir}...`);
 
             // Create a directory for installing Java and ensure it contains a dummy package.json
-            await fse.ensureDir(this.javaCallerSupportDir, { mode: "0777" });
+            await fs.promises.mkdir(this.javaCallerSupportDir, { recursive: true, mode: "0777" });
             const packageJson = `${this.javaCallerSupportDir + path.sep}package.json`;
-            if (!fse.existsSync(packageJson)) {
+            if (!fs.existsSync(packageJson)) {
                 const packageJsonContent = {
                     name: "java-caller-support",
                     version: "1.0.0",
                     description: "Java installations by java-caller (https://github.com/nvuillam/node-java-caller)",
                 };
-                await fse.writeFile(packageJson, JSON.stringify(packageJsonContent), "utf8");
+                await fs.promises.writeFile(packageJson, JSON.stringify(packageJsonContent), "utf8");
             }
 
             // Install appropriate java version using njre
@@ -464,15 +478,15 @@ class JavaCaller {
     // check if one matches with javaType , minimumJavaVersion and maximumJavaVersion
     async findJavaVersionHome() {
         const javaInstallsTopDir = path.join(this.javaCallerSupportDir, "jre");
-        if (!fse.existsSync(javaInstallsTopDir)) {
+        if (!fs.existsSync(javaInstallsTopDir)) {
             return {};
         }
 
-        return await fse
+        return await fs.promises
             .readdir(javaInstallsTopDir)
             .then((items) =>
                 items
-                    .filter((item) => fse.statSync(path.join(javaInstallsTopDir, item)).isDirectory())
+                    .filter((item) => fs.statSync(path.join(javaInstallsTopDir, item)).isDirectory())
                     .map((folder) => {
                         const version = semver.coerce(folder);
                         return { version, folder };
@@ -483,7 +497,7 @@ class JavaCaller {
                         const bin = path.join(home, this.getPlatformBinPath());
                         return { version, folder, home, bin };
                     })
-                    .find(({ bin }) => fse.existsSync(bin)),
+                    .find(({ bin }) => fs.existsSync(bin)),
             )
             .then((match) => {
                 if (!match) return {};

package-lock.json

@@ -37,29 +37,26 @@
   },
   "homepage": "https://github.com/nvuillam/node-java-caller#readme",
   "dependencies": {
-    "debug": "^4.3.4",
-    "fs-extra": "^11.1.1",
     "njre": "^3.0.0",
     "semver": "^7.5.4"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/node": "^25.2.0",
     "eslint": "^10.0.0",
+    "globals": "^17.9.0",
     "mocha": "^11.0.0",
     "prettier": "^3.1.0",
-    "typescript": "^7.0.0",
-    "which": "^7.0.0"
+    "typescript": "^7.0.0"
   },
   "overrides": {
-    "@babel/core": "^8.0.0",
     "brace-expansion": "^5.0.6",
     "diff": "^9.0.0",
     "js-yaml": "^5.0.0",
-    "serialize-javascript": "^7.0.5",
-    "uuid": "^14.0.0"
+    "serialize-javascript": "^7.0.5"
   },
   "engines": {
-    "node": ">=12.0.0"
+    "node": ">=18.0.0"
   },
   "mocha": {
     "require": [