chore(deps): update @socketregistry/packageurl-js and catalog, fix imports

- Change @socketregistry/packageurl-js from explicit 1.3.3 to catalog:
- Update packageurl-js override from 1.3.2 to 1.3.3
- Add @socketregistry/packageurl-js 1.3.3 to catalog
- Update catalog: @socketsecurity/lib 3.0.5 -> 3.0.6
- Update catalog: @socketsecurity/registry 2.0.0 -> 2.0.1
- Update catalog: @socketsecurity/sdk 3.0.28 -> 3.0.30
- Fix import ordering issues in multiple files

Author: jdalton

package.json

@@ -32,7 +32,7 @@
     "@socketregistry/hyrious__bun.lockb": "1.0.19",
     "@socketregistry/indent-string": "1.0.14",
     "@socketregistry/is-interactive": "1.0.6",
-    "@socketregistry/packageurl-js": "1.3.3",
+    "@socketregistry/packageurl-js": "catalog:",
     "@socketregistry/yocto-spinner": "1.0.24",
     "@socketsecurity/config": "3.0.1",
     "@socketsecurity/lib": "3.0.6",
@@ -131,7 +131,7 @@
       "isarray": "npm:@socketregistry/isarray@^1.0.8",
       "lodash": "4.17.21",
       "npm-package-arg": "13.0.0",
-      "packageurl-js": "npm:@socketregistry/packageurl-js@^1.3.2",
+      "packageurl-js": "npm:@socketregistry/packageurl-js@^1.3.3",
       "path-parse": "npm:@socketregistry/path-parse@^1.0.8",
       "safe-buffer": "npm:@socketregistry/safe-buffer@^1.0.9",
       "safer-buffer": "npm:@socketregistry/safer-buffer@^1.0.10",

packages/cli/src/commands/analytics/analytics-app-cli.mts

@@ -4,9 +4,10 @@
 import { pathToFileURL } from 'node:url'
 
 import { render } from 'ink'
-import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import React from 'react'
 
+import { getDefaultLogger } from '@socketsecurity/lib/logger'
+
 const logger = getDefaultLogger()
 
 /**

packages/cli/src/commands/audit-log/audit-log-app-cli.mts

@@ -4,9 +4,10 @@
 import { pathToFileURL } from 'node:url'
 
 import { render } from 'ink'
-import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import React from 'react'
 
+import { getDefaultLogger } from '@socketsecurity/lib/logger'
+
 const logger = getDefaultLogger()
 
 /**

packages/cli/src/commands/scan/suggest_branch_slug.mts

@@ -1,5 +1,5 @@
-import { select } from '@socketsecurity/lib/stdio/prompts'
 import { spawn } from '@socketsecurity/lib/spawn'
+import { select } from '@socketsecurity/lib/stdio/prompts'
 import { stripAnsi } from '@socketsecurity/lib/strings'
 
 export async function suggestBranchSlug(

packages/cli/src/commands/threat-feed/threat-feed-app-cli.mts

@@ -4,9 +4,10 @@
 import { pathToFileURL } from 'node:url'
 
 import { render } from 'ink'
-import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import React from 'react'
 
+import { getDefaultLogger } from '@socketsecurity/lib/logger'
+
 const logger = getDefaultLogger()
 
 /**

packages/cli/src/utils/update/notifier.mts

@@ -96,7 +96,7 @@ function showUpdateNotification(options: UpdateNotificationOptions): void {
       logger.log(formatted.command)
     }
     logger.log(`📝 ${formatted.changelog}`)
-  } catch (error) {
+  } catch (_error) {
     // If formatting or logging fails, show a simpler message.
     const logger = getDefaultLogger()
     const { current, latest, name } = options

packages/cli/test/integration/bundle-validation.test.mts

@@ -117,10 +117,9 @@ describe('Bundle validation', () => {
       }
     }
 
-    expect(
-      result.hasIssue,
-      'Bundle should not contain absolute paths',
-    ).toBe(false)
+    expect(result.hasIssue, 'Bundle should not contain absolute paths').toBe(
+      false,
+    )
   })
 
   it('should not bundle dependencies inline (validate against package.json dependencies)', async () => {

pnpm-lock.yaml

@@ -4,10 +4,11 @@ packages:
 catalog:
   '@babel/parser': 7.28.4
   '@babel/traverse': 7.28.4
+  '@socketregistry/packageurl-js': 1.3.3
   '@socketsecurity/config': 3.0.1
-  '@socketsecurity/lib': 3.0.5
-  '@socketsecurity/registry': 2.0.0
-  '@socketsecurity/sdk': 3.0.28
+  '@socketsecurity/lib': 3.0.6
+  '@socketsecurity/registry': 2.0.1
+  '@socketsecurity/sdk': 3.0.30
   '@types/node': 24.9.2
   del-cli: 6.0.0
   esbuild: 0.25.11