fix(deps): remove malicious tree-sitter-erlang, fix 3 moderate vulns

package.json

@@ -161,7 +161,6 @@
     "tree-sitter-cuda": "^0.21.1",
     "tree-sitter-dart": "^1.0.0",
     "tree-sitter-elixir": "^0.3.5",
-    "tree-sitter-erlang": "github:WhatsApp/tree-sitter-erlang#semver:*",
     "tree-sitter-fsharp": "https://github.com/ionide/tree-sitter-fsharp/archive/refs/tags/0.3.0.tar.gz",
     "tree-sitter-gleam": "github:gleam-lang/tree-sitter-gleam",
     "tree-sitter-go": "^0.25.0",

scripts/build-wasm.ts

@@ -211,7 +211,15 @@ const grammars = [
   { name: 'tree-sitter-clojure', pkg: 'tree-sitter-clojure', sub: null },
   { name: 'tree-sitter-julia', pkg: 'tree-sitter-julia', sub: null },
   { name: 'tree-sitter-r', pkg: '@eagleoutice/tree-sitter-r', sub: null },
-  { name: 'tree-sitter-erlang', pkg: 'tree-sitter-erlang', sub: null },
+  // tree-sitter-erlang: the WhatsApp/tree-sitter-erlang npm package was flagged as malware
+  // (GHSA-rphw-c8qj-jv84). The devDependency has been removed; grammars/*.wasm is gitignored
+  // so the Erlang WASM is not present in the repository. Erlang parsing is unavailable in
+  // the WASM engine until a clean replacement is integrated. To restore support:
+  //   1. npm install github:the-mikedavis/tree-sitter-erlang
+  //   2. Add this entry back to the grammars array
+  //   3. Run `npm run build:wasm`, validate the output
+  //   4. Add `!grammars/tree-sitter-erlang.wasm` to .gitignore and commit the WASM
+  //   5. Remove the temporary devDependency again
   { name: 'tree-sitter-solidity', pkg: 'tree-sitter-solidity', sub: null },
   { name: 'tree-sitter-objc', pkg: 'tree-sitter-objc', sub: null },
   { name: 'tree-sitter-cuda', pkg: 'tree-sitter-cuda', sub: null },

scripts/check-grammar-versions.mjs

@@ -61,7 +61,6 @@ const GRAMMAR_NPM_PACKAGES = [
   'tree-sitter-cuda',
   'tree-sitter-dart',
   'tree-sitter-elixir',
-  'tree-sitter-erlang',
   'tree-sitter-fsharp',
   'tree-sitter-gleam',
   'tree-sitter-go',

tests/benchmarks/regression-guard.test.ts

@@ -311,6 +311,13 @@ const KNOWN_REGRESSIONS = new Set([
   '3.11.2:Full build',
   '3.12.0:Full build',
   '3.12.0:1-file rebuild',
+  // tree-sitter-erlang devDependency removed (GHSA-rphw-c8qj-jv84 — malware).
+  // The erlang WASM is no longer built, so erlang resolution drops to 0%.
+  // These entries exempt the expected precision/recall drop on every build
+  // that follows the 3.12.0 baseline until a clean replacement grammar is
+  // integrated and a new baseline is captured.
+  '3.12.0:resolution erlang precision',
+  '3.12.0:resolution erlang recall',
 ]);
 
 /**