Transitive dependency on eslint@8 via rewire

[ilanoh]

Summary

@getbrevo/brevo depends on rewire@7.0.0, which in turn pulls in eslint@8 as a dependency. This forces projects that have upgraded to ESLint 9 to carry two separate versions of eslint in their dependency tree.

Dependency chain

@getbrevo/brevo@3.0.1
  └── rewire@7.0.0
        └── eslint@8.57.1

Impact

• Consumers using ESLint 9+ end up with two eslint versions installed
• Extra disk space and install time
• Potential confusion when debugging linting issues

Suggestion

rewire appears to be a dev/test utility for module mocking. If it's not used at runtime by the SDK, it could likely be moved to devDependencies (or removed entirely from the published package), which would prevent it from being pulled into consumers' node_modules.

[simonhammes]

And this has a transitive dependency on minimatch, which is affected by GHSA-3ppc-4f35-3m26 :(