chore: update eslint unicorn plugin to v65 (#8838)

* chore: update eslint unicorn plugin to v65

* fixup!

* perf(core): replace split-then-index with an allocation-free getSegment

Reading `str.split(sep)[i]` allocates the full segment array, and the
unicorn rule's `split(sep, i + 1)[i]` rewrite is worse for a string
separator: passing a limit drops V8 off its constant-limit fast path,
paying a per-call ToUint32 plus the array allocation. `getSegment`
scans with `indexOf` and slices out the one segment the caller wants.

Node 24.15 / V8 13.6, 5M ops x 7 trials, drop best+worst:

  " " [1]  helper 24.6ns  split 30.6ns (-20%)  split+limit 86.6ns
  "-" [0]  helper 25.4ns  split 35.9ns (-29%)  split+limit 74.3ns
  "." [0]  helper 16.0ns  split 36.4ns (-56%)  split+limit 67.2ns

* test: cover uncovered diff lines from the unicorn v65 rewrite

The unicorn autofix touched branches no existing spec exercised:

1. ws: a connection carrying x-forwarded-proto now asserts the server
   span's http.url resolves to wss, reaching getRequestProtocol's proxy
   arm (and the getSegment call inside it).
2. oracledb: a callback-form pool.getConnection pins the callback path,
   which only the promise form covered before.

The ai-sdk `messages.findLast(...)` arm is left for the PR author: covering
it needs a VCR cassette recorded against a real OPENAI_API_KEY, since the
test agent matches cassettes by request body and runs CI in 404-on-miss mode.

Test-only, no production code changes.

* test(ai): cover the messages.findLast() arm in setTextGenerationTags and setObjectGenerationTags

The two methods use promptInfo.messages.findLast() when the caller passes
a messages array without a top-level prompt string. Existing tests all use
the prompt: '' form, which short-circuits to promptInfo.prompt and leaves
lines 234 and 250 uncovered.

Both new tests use an inline mock fetch (same pattern as the prompt-cache
capture tests), bypassing the VCR proxy so no cassette recording is needed:

- generateText with messages: array and three turns verifies that the last
  user message is extracted as inputValue.
- generateObject with output: 'no-schema' and the same messages array
  verifies the same path in setObjectGenerationTags.

Both tests skip ai < 5.0.0 where the mock-fetch provider wiring differs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* perf(fastify): keep the addHook wrapper allocation-free on the fast path

The wrapper declared `wrappedHook (...args)`, which materialises a fresh args
array on every fastify hook invocation, including the common case where none of
the wrap-fed channels has a subscriber. Forward the `arguments` object untouched
on the fast path and copy or index it only in the slow path, so the default
request path allocates nothing.

* chore(deps): update eslint to v10, unicorn to v68, switch to eslint-plugin-import-x

The eslint 9->10 and unicorn 65->68 bumps turn on a large set of new recommended
rules. The newly-firing ones are deactivated in the config with per-rule counts,
grouped by intent (autofixable follow-up, needs-audit, never-activate), so this
bump stays free of production source churn; enabling them is left to follow-ups.

Some deactivated rules may surface real bugs (unicorn/no-duplicate-logical-operands,
no-duplicate-if-branches, no-loop-iterable-mutation, and the core no-unassigned-vars);
their config comments flag them for a focused audit.

Changes the bump requires directly:

1. Port the repo's custom eslint rules to the v10 context API; context.getSourceCode()
   was removed in favour of context.sourceCode.
2. eslint 10 drops Node.js 18, so .nvmrc moves to 22.
3. Rename getRunInChildContextSubtype and drop an unnecessary String.raw to satisfy
   the two rules kept on (consistent-compound-words, prefer-string-raw).
4. Remove stale unicorn/no-array-for-each disable directives; the rule was renamed to
   no-for-each, which is deactivated here.

* chore: deduplicate yarn.lock

* Apply suggestion from @BridgeAR

* test(llmobs): use installed OpenAI fixture version

The message extraction tests referenced a helper that does not exist, so lint failed before the versioned provider fixture could load.

* ci(lint): update validation code for unicorn v68

The validation code landed after the branch's previous base, so Unicorn 68's new checks only surfaced once the branch was rebased.

* chore(lint): use Array.at for latest Cypress screenshot handler

* test(cypress): cover latest manual screenshot handler

* ci(licenses): include deduplicated vendor dependencies

npm list represents hoisted transitive packages without a resolved URL. Skipping those entries makes the local license gate report valid attributions as extraneous when the root dependency graph no longer supplies the same package.

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com>

Author: 3 people

ci/test-optimization-validation/command-output-policy.js

@@ -108,7 +108,7 @@ function assertOutputParentsUnchanged (state) {
     }
   }
 
-  const lastExisting = state.parentIdentities[state.parentIdentities.length - 1].path
+  const lastExisting = state.parentIdentities.at(-1).path
   const relative = path.relative(lastExisting, path.dirname(state.outputPath))
   let current = lastExisting
   for (const segment of relative ? relative.split(path.sep) : []) {

ci/test-optimization-validation/command-runner.js

@@ -645,7 +645,7 @@ function formatApprovalArgument (value) {
   const argument = String(value)
   if (/^[A-Za-z0-9_@%+=:,./\\-]+$/.test(argument)) return argument
   if (process.platform === 'win32') return JSON.stringify(argument)
-  return `'${argument.replaceAll('\'', String.raw`'"'"'`)}'`
+  return `'${argument.replaceAll('\'', '\'"\'"\'')}'`
 }
 
 function serializeDisplayCommand (command) {

ci/test-optimization-validation/command-suitability.js

@@ -101,6 +101,10 @@ function isProducedBySetup (framework, localPath) {
   return false
 }
 
+/**
+ * @param {{ usesShell?: boolean, argv?: string[] }} command
+ * @param {string} repositoryRoot
+ */
 function getRepositoryYarnError (command, repositoryRoot) {
   if (command.usesShell || path.basename(command.argv?.[0] || '') !== 'yarn') return
 
@@ -112,7 +116,7 @@ function getRepositoryYarnError (command, repositoryRoot) {
       .sort()
   } catch {}
   if (releases?.length > 0) {
-    const release = path.posix.join('.yarn', 'releases', releases[releases.length - 1])
+    const release = path.posix.join('.yarn', 'releases', releases.at(-1))
     return `uses bare "yarn", but this repository pins ${release}. Use the structured command ` +
       `argv [process.execPath, "${release}", ...] so validation does not depend on an ambient Yarn shim.`
   }

ci/test-optimization-validation/plan-writer.js

@@ -136,7 +136,9 @@ function formatExecutionPlan ({
       'preloads are shown as package names; the validator resolves them from the installed `dd-trace` package.',
     ''
   )
-  for (const framework of manifest.frameworks.filter(entry => entry.status === 'runnable')) {
+  for (const framework of manifest.frameworks) {
+    if (framework.status !== 'runnable') continue
+
     appendFrameworkExecutions(
       lines,
       framework,
@@ -273,7 +275,9 @@ function formatApprovalSummary ({
   }
 
   lines.push('', '## Commands', '')
-  for (const framework of manifest.frameworks.filter(entry => entry.status === 'runnable')) {
+  for (const framework of manifest.frameworks) {
+    if (framework.status !== 'runnable') continue
+
     appendApprovalSummaryFramework(lines, framework, requestedScenario, repositoryRoot)
   }
 
@@ -490,7 +494,9 @@ function getApprovalSummaryPath (out) {
  * @returns {void}
  */
 function assertPlannedExecutablesAvailable (manifest, requestedScenario) {
-  for (const framework of manifest.frameworks.filter(entry => entry.status === 'runnable')) {
+  for (const framework of manifest.frameworks) {
+    if (framework.status !== 'runnable') continue
+
     const plannedCommands = getPlannedCommands(framework, requestedScenario)
     for (const plannedCommand of plannedCommands) {
       const executable = getUnavailableExecutable(plannedCommand.command)
@@ -1016,7 +1022,9 @@ function formatFrameworkLabel (framework, repositoryRoot) {
  */
 function appendCommandIntegrity (lines, manifest, requestedScenario) {
   const executables = new Map()
-  for (const framework of manifest.frameworks.filter(entry => entry.status === 'runnable')) {
+  for (const framework of manifest.frameworks) {
+    if (framework.status !== 'runnable') continue
+
     for (const { command } of getPlannedCommands(framework, requestedScenario)) {
       const executable = getApprovedExecutable(command)
       if (executable) {

ci/test-optimization-validation/redaction.js

@@ -27,13 +27,13 @@ const EXACT_SECRET_ASSIGNMENT_NAME_SOURCE = [
   'JWT',
   'WEBHOOK(?:_URL)?',
 ].join('|')
-const SECRET_NAME_CHARS = String.raw`[A-Za-z0-9_.-]`
+const SECRET_NAME_CHARS = '[A-Za-z0-9_.-]'
 const SECRET_ASSIGNMENT_NAME_SOURCE = [
-  String.raw`(?:${EXACT_SECRET_ASSIGNMENT_NAME_SOURCE})`,
-  String.raw`[A-Za-z_]${SECRET_NAME_CHARS}*(?:${SECRET_NAME_SOURCE})${SECRET_NAME_CHARS}*`,
-  String.raw`[A-Za-z_]${SECRET_NAME_CHARS}*[-_]PASS`,
-  String.raw`[A-Za-z_]${SECRET_NAME_CHARS}*[-_]AUTH(?:ORIZATION)?`,
-  String.raw`[A-Za-z_]${SECRET_NAME_CHARS}*[-_](?:PAT|JWT|WEBHOOK(?:_URL)?)`,
+  `(?:${EXACT_SECRET_ASSIGNMENT_NAME_SOURCE})`,
+  `[A-Za-z_]${SECRET_NAME_CHARS}*(?:${SECRET_NAME_SOURCE})${SECRET_NAME_CHARS}*`,
+  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_]PASS`,
+  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_]AUTH(?:ORIZATION)?`,
+  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_](?:PAT|JWT|WEBHOOK(?:_URL)?)`,
   'PASS',
   'AUTH',
   'AUTHORIZATION',
@@ -68,7 +68,7 @@ const SECRET_FLAG_PATTERN = new RegExp(
   'gi'
 )
 const SECRET_FLAG_NAME_PATTERN = new RegExp(
-  String.raw`^--(?:${SECRET_FLAG_SOURCE})(?:-[A-Za-z0-9]+)*$`,
+  `^--(?:${SECRET_FLAG_SOURCE})(?:-[A-Za-z0-9]+)*$`,
   'i'
 )
 const AUTH_HEADER_PATTERN = /\b(Bearer)\s+([^\s'",}\]]+)/gi
@@ -92,10 +92,10 @@ const JWT_VALUE_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9
 const KNOWN_TOKEN_VALUE_PATTERN =
   /\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,})\b/g
 const SECRET_HEADER_ENV_NAME_SOURCE = [
-  String.raw`(?:${SECRET_NAME_SOURCE}|PAT|JWT|WEBHOOK(?:_URL)?)`,
-  String.raw`[A-Za-z_]${SECRET_NAME_CHARS}*(?:${SECRET_NAME_SOURCE})${SECRET_NAME_CHARS}*`,
-  String.raw`[A-Za-z_]${SECRET_NAME_CHARS}*[-_]AUTH(?:ORIZATION)?`,
-  String.raw`[A-Za-z_]${SECRET_NAME_CHARS}*[-_](?:PAT|JWT|WEBHOOK(?:_URL)?)`,
+  `(?:${SECRET_NAME_SOURCE}|PAT|JWT|WEBHOOK(?:_URL)?)`,
+  `[A-Za-z_]${SECRET_NAME_CHARS}*(?:${SECRET_NAME_SOURCE})${SECRET_NAME_CHARS}*`,
+  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_]AUTH(?:ORIZATION)?`,
+  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_](?:PAT|JWT|WEBHOOK(?:_URL)?)`,
 ].join('|')
 const SECRET_HEADER_NAME_SOURCE = [
   'dd-api-key',

ci/test-optimization-validation/scenarios/ci-wiring.js

@@ -694,6 +694,10 @@ function getMonorepoFindings ({ framework, command, probe }) {
   return findings
 }
 
+/**
+ * @param {object|undefined} probe
+ * @param {string} name
+ */
 function hasProbeTool (probe, name) {
   const signals = [
     ...(probe?.wrapperSignals || []),
@@ -703,6 +707,9 @@ function hasProbeTool (probe, name) {
   return signals.some(signal => signal.name === name)
 }
 
+/**
+ * @param {Array<{ name?: string }>} signals
+ */
 function formatToolNames (signals) {
   const names = []
   const seen = new Set()
@@ -715,9 +722,12 @@ function formatToolNames (signals) {
 
   if (names.length === 0) return ''
   if (names.length === 1) return names[0]
-  return `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`
+  return `${names.slice(0, -1).join(', ')} and ${names.at(-1)}`
 }
 
+/**
+ * @param {string|undefined} frameworkName
+ */
 function getDisplayFrameworkName (frameworkName) {
   return {
     cucumber: 'Cucumber',

eslint-rules/eslint-prefer-assert-match.mjs

@@ -47,7 +47,7 @@ export default {
   },
 
   create (context) {
-    const sourceCode = context.getSourceCode()
+    const sourceCode = context.sourceCode
 
     return {
       CallExpression (node) {

eslint-rules/eslint-require-boolean-assert-message.mjs

@@ -106,7 +106,7 @@ export default {
 
         if (isTrivialExpression(firstArg)) return
 
-        const sourceCode = context.getSourceCode()
+        const sourceCode = context.sourceCode
         const fixMessage = buildAutofixMessage(firstArg, sourceCode)
 
         context.report({

eslint-rules/eslint-safe-typeof-object.mjs

@@ -23,7 +23,7 @@ export default {
         ) {
           // Get the expression being checked (x or x.y)
           const targetNode = node.left.argument
-          const targetExpression = context.getSourceCode().getText(targetNode)
+          const targetExpression = context.sourceCode.getText(targetNode)
 
           const hasNullCheck = isGuardedInLogicalExpression(node, targetNode) ||
             isGuardedInConditionalExpression(node, targetNode) ||
@@ -384,7 +384,7 @@ function isGuardedByIfStatement (node, targetNode) {
 }
 
 function walkAst (context, node, visitor) {
-  const visitorKeys = context.getSourceCode().visitorKeys
+  const visitorKeys = context.sourceCode.visitorKeys
 
   /** @type {unknown[]} */
   const stack = [node]

eslint.config.mjs

@@ -6,7 +6,7 @@ import { readFileSync } from 'fs'
 import eslintPluginJs from '@eslint/js'
 import eslintPluginStylistic from '@stylistic/eslint-plugin'
 import eslintPluginCypress from 'eslint-plugin-cypress'
-import eslintPluginImport from 'eslint-plugin-import'
+import eslintPluginImport from 'eslint-plugin-import-x'
 import eslintPluginJSDoc from 'eslint-plugin-jsdoc'
 import eslintPluginMocha from 'eslint-plugin-mocha'
 import eslintPluginN from 'eslint-plugin-n'
@@ -265,7 +265,7 @@ export default [
       'import/no-self-import': 'error',
       'import/order': ['error', {
         // `dd-trace` must be allowed first (and is often intentionally required before any other module).
-        // eslint-plugin-import defaults can exclude some import types (notably `builtin`) from `pathGroups`,
+        // eslint-plugin-import-x defaults can exclude some import types (notably `builtin`) from `pathGroups`,
         // which would make the `dd-trace` exception below a no-op. Make this explicit.
         pathGroupsExcludedImportTypes: [],
         pathGroups: [
@@ -324,6 +324,9 @@ export default [
       'no-sequences': 'error',
       'no-template-curly-in-string': 'error',
       'no-throw-literal': 'error',
+      // Surfaces pre-existing latent bugs (always-undefined vars in tests/intake helpers)
+      // unrelated to this tooling bump; worth a focused follow-up.
+      'no-unassigned-vars': 'off',
       'no-undef-init': 'error',
       'no-unmodified-loop-condition': 'error',
       'no-unneeded-ternary': ['error', { defaultAssignment: false }],
@@ -353,6 +356,8 @@ export default [
       'prefer-const': ['error', { destructuring: 'all' }],
       'prefer-promise-reject-errors': 'error',
       'prefer-regex-literals': ['error', { disallowRedundantWrapping: true }],
+      // Newly enabled by the ESLint 10 bump; deferred with no-unassigned-vars above.
+      'preserve-caught-error': 'off',
       'promise/param-names': 'error',
       'symbol-description': 'error',
       'unicode-bom': ['error', 'never'],
@@ -580,41 +585,121 @@ export default [
 
       ...eslintPluginUnicorn.configs.recommended.rules,
 
-      // Overriding recommended unicorn rules
-      'unicorn/catch-error-name': ['off', { name: 'err' }], // 166 errors
+      // Overriding recommended unicorn rules.
+      // Rules not listed here are left at the `recommended` default. The v65→v68 bump
+      // turned ~130 rules on in `recommended`; the entries below are the ones that fire
+      // on our source and are intentionally kept off (counts are from the v68 run).
+      'unicorn/catch-error-name': ['off', { name: 'err' }], // Many errors
       'unicorn/expiring-todo-comments': 'off',
-      'unicorn/explicit-length-check': 'off', // 68 errors
-      'unicorn/filename-case': ['off', { case: 'kebabCase' }], // 59 errors
-      'unicorn/prefer-at': 'off', // 17 errors | Difficult to fix
-      'unicorn/prefer-export-from': ['error', { ignoreUsedVariables: true }],
-      'unicorn/prevent-abbreviations': 'off', // too strict
+      'unicorn/filename-case': ['off', { case: 'kebabCase' }], // Many errors
+      'unicorn/name-replacements': 'off', // Many errors | naming churn (split out of prevent-abbreviations)
+      'unicorn/prevent-abbreviations': 'off', // Many errors
 
       // These rules require a newer Node.js version than we support
       'unicorn/no-array-reverse': 'off', // Node.js 20
       'unicorn/no-array-sort': 'off', // Node.js 20
+      'unicorn/prefer-dispose': 'off', // Explicit resource management (newer Node.js)
+      'unicorn/prefer-iterator-to-array': 'off', // Iterator helpers (Node.js 22)
+      'unicorn/prefer-iterator-to-array-at-end': 'off', // Iterator helpers (Node.js 22)
+      'unicorn/prefer-promise-with-resolvers': 'off', // 6 errors | Promise.withResolvers (Node.js 22)
+      'unicorn/prefer-temporal': 'off', // Temporal is not stable on supported Node.js
+      'unicorn/prefer-uint8array-base64': 'off', // Uint8Array base64 (Node.js 22)
 
-      // These rules could potentially evaluated again at a much later point
+      // These rules could potentially be evaluated again at a much later point
+      'unicorn/class-reference-in-static-methods': 'off', // 6 errors
+      'unicorn/consistent-class-member-order': 'off', // 55 errors | ordering churn
+      'unicorn/consistent-conditional-object-spread': 'off', // 3 errors
+      'unicorn/consistent-optional-chaining': 'off', // 3 errors
+      'unicorn/explicit-length-check': 'off', // Not a big advantage
+      'unicorn/explicit-timer-delay': 'off', // Covered by our own timer lint rules
       'unicorn/no-array-callback-reference': 'off',
+      'unicorn/no-computed-property-existence-check': 'off', // 160 errors | needs an audit
+      'unicorn/no-declarations-before-early-exit': 'off', // 62 errors
+      'unicorn/no-duplicate-if-branches': 'off', // 1 error | may surface real bugs
+      'unicorn/no-duplicate-logical-operands': 'off', // 2 errors | may surface real bugs
+      'unicorn/no-error-property-assignment': 'off', // 6 errors
       'unicorn/no-for-loop': 'off', // Activate if this is resolved https://github.com/sindresorhus/eslint-plugin-unicorn/issues/2664
-      'unicorn/no-nested-ternary': 'off', // Not really an issue in the code and the benefit is small
+      'unicorn/no-incorrect-template-string-interpolation': 'off', // 3 errors | audit for real bugs first
+      'unicorn/no-invalid-argument-count': 'off', // 98 errors | high false-positive risk, worth a focused pass
+      'unicorn/no-loop-iterable-mutation': 'off', // 2 errors | may surface real bugs
+      'unicorn/no-nonstandard-builtin-properties': 'off', // 34 errors | needs an audit
       'unicorn/no-this-assignment': 'off', // This would need some further refactoring and the benefit is small
+      'unicorn/no-undeclared-class-members': 'off', // 272 errors | requires declaring every field
+      'unicorn/no-unreadable-array-destructuring': 'off', // 4 errors | not autofixable, needs manual rewrite
+      'unicorn/no-unreadable-for-of-expression': 'off', // 32 errors
+      'unicorn/no-unreadable-object-destructuring': 'off', // 57 errors
+      'unicorn/no-unsafe-string-replacement': 'off', // 6 errors
+      'unicorn/no-useless-recursion': 'off', // 2 errors
       'unicorn/prefer-code-point': 'off', // Should be activated, but needs a refactor of some code
+      'unicorn/prefer-early-return': 'off', // 67 errors | tension with our positive-`if` style
+      'unicorn/prefer-hoisting-branch-code': 'off', // 2 errors | reshapes branch bodies
+      'unicorn/prefer-minimal-ternary': 'off', // 24 errors
+      'unicorn/prefer-number-is-safe-integer': 'off', // 17 errors
+      'unicorn/prefer-object-iterable-methods': 'off', // 56 errors
+      'unicorn/prefer-queue-microtask': 'off', // process.nextTick semantics differ
+      'unicorn/prefer-smaller-scope': 'off', // 3 errors
+      'unicorn/prefer-split-limit': 'off', // 23 errors
+      'unicorn/require-array-sort-compare': 'off', // 8 errors | may surface real default-sort bugs
 
       // The following rules should not be activated!
+      'unicorn/consistent-boolean-name': 'off', // Would rename public API and config booleans
       'unicorn/import-style': 'off', // Questionable benefit
+      'unicorn/max-nested-calls': 'off', // Questionable benefit
       'unicorn/no-array-reduce': 'off', // Questionable benefit
-      'unicorn/no-hex-escape': 'off', // Questionable benefit
+      'unicorn/no-array-splice': 'off', // toSpliced copies the whole array (perf)
+      'unicorn/no-break-in-nested-loop': 'off', // Conflicts with our performance-oriented loops
+      'unicorn/no-global-object-property-assignment': 'off', // We use globalThis[Symbol.for('dd-trace')]
+      'unicorn/no-nested-ternary': 'off', // Not really an issue in the code and the benefit is small
       'unicorn/no-new-array': 'off', // new Array is often used for performance reasons
       'unicorn/no-null': 'off', // We do not control external APIs and it is hard to differentiate these
+      'unicorn/no-return-array-push': 'off', // Questionable benefit
+      'unicorn/no-this-outside-of-class': 'off', // This will not work for us
+      'unicorn/no-top-level-assignment-in-function': 'off', // Module-level singletons are assigned from functions
+      'unicorn/no-useless-else': 'off', // Covered by core no-else-return
+      'unicorn/operator-assignment': 'off', // Covered by core operator-assignment
+      'unicorn/prefer-array-last-methods': 'off', // Questionable benefit
+      'unicorn/prefer-await': 'off', // We avoid async/await in production hot paths
       'unicorn/prefer-event-target': 'off', // Benefit only outside of Node.js
       'unicorn/prefer-global-this': 'off', // Questionable benefit in Node.js alone
+      'unicorn/prefer-includes-over-repeated-comparisons': 'off', // Bad for performance
       'unicorn/prefer-math-trunc': 'off', // Math.trunc is not a 1-to-1 replacement for most of our usage
       'unicorn/prefer-module': 'off', // We use CJS
       'unicorn/prefer-node-protocol': 'off', // May not be used due to guardrails
+      'unicorn/prefer-number-coercion': 'off', // Number() is not a 1-to-1 replacement for parseInt/parseFloat
+      'unicorn/prefer-private-class-fields': 'off', // Many `_underscore` fields cross module boundaries
       'unicorn/prefer-reflect-apply': 'off', // Questionable benefit and more than 500 matches
+      'unicorn/prefer-short-arrow-method': 'off', // Method shorthand is intentional; arrow properties change `this`
       'unicorn/prefer-switch': 'off', // Questionable benefit
       'unicorn/prefer-top-level-await': 'off', // Only useful when using ESM
+      'unicorn/prefer-unicode-code-point-escapes': 'off', // Replaces the dropped no-hex-escape; questionable benefit
       'unicorn/switch-case-braces': 'off', // Questionable benefit
+
+      // Safe to enable in a follow-up: autofixable and aligned with our style. Kept off
+      // here only to keep this version bump free of source churn (counts from the v68 run).
+      'unicorn/logical-assignment-operators': 'off', // 42 errors | matches our ??=/||= usage
+      'unicorn/no-confusing-array-splice': 'off', // 1 error
+      'unicorn/no-for-each': 'off', // 10 errors | we already prefer for-of in production
+      'unicorn/no-negated-array-predicate': 'off', // 2 errors
+      'unicorn/no-negated-comparison': 'off', // 1 error
+      'unicorn/no-subtraction-comparison': 'off', // 2 errors
+      'unicorn/no-unnecessary-boolean-comparison': 'off', // 6 errors
+      'unicorn/no-unnecessary-global-this': 'off', // 4 errors
+      'unicorn/no-unnecessary-splice': 'off', // 2 errors
+      'unicorn/no-useless-concat': 'off', // 4 errors
+      'unicorn/no-useless-continue': 'off', // 1 error
+      'unicorn/no-useless-delete-check': 'off', // 1 error
+      'unicorn/no-useless-fallback-in-spread': 'off', // 5 errors
+      'unicorn/no-useless-override': 'off', // 1 error
+      'unicorn/no-useless-template-literals': 'off', // 13 errors
+      'unicorn/prefer-array-from-map': 'off', // 6 errors
+      'unicorn/prefer-boolean-return': 'off', // 1 error
+      'unicorn/prefer-continue': 'off', // 52 errors
+      'unicorn/prefer-direct-iteration': 'off', // 5 errors
+      'unicorn/prefer-else-if': 'off', // 6 errors
+      'unicorn/prefer-global-number-constants': 'off', // 3 errors
+      'unicorn/prefer-logical-operator-over-ternary': 'off', // 3 errors
+      'unicorn/prefer-ternary': 'off', // 16 errors
+      'unicorn/prefer-unary-minus': 'off', // 1 error
     },
   },
   {