BREAKING: Bump all ESLint dependencies #351
Conversation
|
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again.
Next stepsWhat is new author?A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package. Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. What is shell access?This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code. Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. What is network access?This module accesses the network. Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
| "eslint-plugin-import": "~2.26.0", | ||
| "eslint-plugin-jsdoc": "^39.6.2 || ^41 || ^43.0.7", |
There was a problem hiding this comment.
I'm not sure why we used this range before, but I replaced it with the latest (Node.js 16-compatible) version. I can revert if there's a good reason to have this range.
cc @legobeat
There was a problem hiding this comment.
| 'max-statements-per-line': [ | ||
| 'error', | ||
| { | ||
| max: 1, | ||
| }, | ||
| ], |
There was a problem hiding this comment.
Our validation script was complaining about this being handled by Prettier.
| 'jsdoc/tag-lines': [ | ||
| 'error', | ||
| 'any', | ||
| { | ||
| startLines: 1, | ||
| }, | ||
| ], |
There was a problem hiding this comment.
AFAIK this matches the previous behaviour, where one line between the description and the first tag is required.
| // Should be disabled per Prettier | ||
| '@typescript-eslint/no-extra-semi': 'off', |
There was a problem hiding this comment.
Our validation script was complaining about this being handled by Prettier.
| @@ -1,3 +1,6 @@ | |||
| { | |||
| "compilerOptions": { | |||
| "strictNullChecks": true | |||
There was a problem hiding this comment.
This is now required by @typescript-eslint/eslint-plugin when type checking is enabled. I think most of our repos use strict which also enables this anyway.
Mrtenz
changed the title
|
Thanks so much for doing this work, this is super helpful. I'll try to take a look soon. |
Mrtenz
force-pushed
the
mrtenz/bump-dependencies
branch
from
69a7ea5 to
4eb7750
Compare
|
Bumping to Prettier v3 will require some more changes, so we may want to do that separately.
|
|
@Mrtenz Ping on this PR when you get a chance. |
Mrtenz
force-pushed
the
mrtenz/bump-dependencies
branch
from
6cfabce to
7e7a6f6
Compare
This bumps all ESLint and related dependencies to the latest version which has support for Node 16. When we drop support for Node 16, some dependencies can be bumped again.
The exceptions are:
eslint-plugin-import, which has a regression since>=27.0.0. I'm planning to swap it out witheslint-plugin-import-x(a fork ofeslint-plugin-import) since it has significantly better performance regardless.@metamask/auto-changelog.Closes #349.
Closes #338.
Breaking changes
@typescript-eslint/eslint-pluginnow requires a boolean forparserOptions.project, instead of a path totsconfig.json.@typescript-eslint/eslint-pluginnow requiresstrictNullChecksto be enabled.