[BryanFRD]

Sonar quick win: typescript:S3735 (two occurrences in npm/types-check.ts). The hook bodies now read the context field through console.log; the npm types check still passes.

Skipped:

• docker:S8431 (Dockerfile tag plus digest): the pin is deliberate, the digest gives reproducible builds and the tag keeps Renovate updates readable.

False positive:

• javascript:S4036 (scripts/embed-release-data.js): execFileSync resolves gh through PATH in a release script that only runs in CI on a runner with a controlled PATH.

[ferrfleet-interne]

Approve. The change replaces void expr with console.log(expr) in the type fixture npm/types-check.ts, and both checks stay meaningful.

Review

• console resolves through the default DOM lib used by the CI tsc call, and the hook still returns void, so it fits HookFunction.
• ctx.nope is still an unknown-property error, so the @ts-expect-error directive remains satisfied.
• tsc was not run locally (npx is unavailable in the runner), so this rests on reading the types.

Suggestions

• npm/types-check.ts:3 (suggestion): console.log(ctx.newVersion) only checks that the property exists, and Sonar may flag console usage in turn. A typed binding pins newVersion to string and makes the positive check stronger:
  postTag: (ctx) => { const version: string = ctx.newVersion; console.log(version); }

Formal verification

Property	Result
none applicable	nothing to prove

The only changed file is a compile-time type fixture with no runtime logic, so no harnesses were written. By reading only (no TypeScript compiler in the image), console.log returns void, which fits HookFunction = (ctx: HookContext) => void | Promise<void> (npm/types/hook-context.d.ts:38).