BREAKING: Bump all ESLint dependencies #351

Mrtenz · 2024-03-27T12:30:21Z

This bumps all ESLint and related dependencies to the latest version which has support for Node 16. When we drop support for Node 16, some dependencies can be bumped again.

The exceptions are:

eslint-plugin-import, which has a regression since >=27.0.0. I'm planning to swap it out with eslint-plugin-import-x (a fork of eslint-plugin-import) since it has significantly better performance regardless.
Prettier and related dependencies, which has breaking changes which are incompatible with @metamask/auto-changelog.

Closes #349.
Closes #338.

Breaking changes

@typescript-eslint/eslint-plugin now requires a boolean for parserOptions.project, instead of a path to tsconfig.json.
@typescript-eslint/eslint-plugin now requires strictNullChecks to be enabled.

socket-security · 2024-03-27T12:30:54Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@es-joy/jsdoccomment@0.41.0	None	`0`	113 kB	brettz9
npm/@eslint/eslintrc@3.1.0	filesystem, unsafe	`+1`	785 kB	eslintbot
npm/@isaacs/cliui@8.0.2	None	`0`	27.8 kB	isaacs
npm/@lavamoat/aa@4.2.0	None	`0`	19.8 kB	boneskull
npm/@lavamoat/allow-scripts@3.0.4	environment	`0`	45.8 kB	boneskull
npm/@npmcli/agent@2.2.1	environment, network	`0`	17.7 kB	npm-cli-ops
npm/@npmcli/fs@3.1.1	filesystem	`0`	26.5 kB	lukekarrys
npm/@npmcli/git@5.0.4	filesystem	`0`	21.8 kB	npm-cli-ops
npm/@npmcli/package-json@5.0.0	filesystem	`0`	37 kB	npm-cli-ops
npm/@npmcli/promise-spawn@7.0.2	environment, shell	`0`	12.2 kB	npm-cli-ops
npm/@npmcli/run-script@7.0.4	environment	`0`	18.4 kB	npm-cli-ops
npm/@pkgjs/parseargs@0.11.0	None	`0`	74.2 kB	oss-bot
npm/@pkgr/core@0.1.1	None	`0`	8.54 kB	jounqin
npm/@typescript-eslint/eslint-plugin@6.21.0	Transitive: environment	`+5`	4.54 MB	jameshenry
npm/@typescript-eslint/parser@6.21.0	None	`+1`	173 kB	jameshenry
npm/@typescript-eslint/type-utils@6.21.0	None	`0`	109 kB	jameshenry
npm/@ungap/structured-clone@1.2.0	None	`0`	26.2 kB	webreflection
npm/abbrev@2.0.0	None	`0`	4.83 kB	lukekarrys
npm/agentkeepalive@4.2.1	network	`0`	38.8 kB	fengmk2
npm/bin-links@4.0.3	filesystem	`0`	20.6 kB	npm-cli-ops
npm/builtin-modules@3.3.0	unsafe	`0`	4.51 kB	sindresorhus
npm/cacache@18.0.3	filesystem	`+2`	756 kB	npm-cli-ops
npm/comment-parser@1.4.1	None	`0`	366 kB	yavorskiys
npm/create-jest@29.7.0	None	`0`	15.9 kB	simenb
npm/eastasianwidth@0.2.0	None	`0`	13.6 kB	komagata
npm/eslint-compat-utils@0.5.0	filesystem	`0`	48.6 kB	ota-meshi
npm/eslint-plugin-es-x@7.6.0	None	`0`	396 kB	eslint-community-bot
npm/eslint-plugin-jsdoc@43.2.0	None	`+3`	2.26 MB	gajus
npm/eslint-plugin-jsdoc@47.0.2	filesystem	`0`	1.38 MB	gajus
npm/eslint-plugin-mocha@10.4.1	None	`0`	94 kB	lo1tuma
npm/eslint-plugin-n@16.6.2	filesystem	`+1`	400 kB	weiran.zsd
npm/espree@10.0.1	None	`+1`	106 kB	eslintbot
npm/exponential-backoff@3.1.1	None	`0`	37.3 kB	sssayegh
npm/foreground-child@3.1.1	shell	`0`	60.4 kB	isaacs
npm/fs-minipass@3.0.3	filesystem	`0`	14.4 kB	npm-cli-ops
npm/get-stdin@9.0.0	None	`0`	4.54 kB	sindresorhus
npm/get-tsconfig@4.7.3	filesystem, unsafe	`0`	101 kB	hirokiosame
npm/globals@15.3.0	None	`0`	152 kB	sindresorhus
npm/hasown@2.0.2	None	`0`	8.77 kB	ljharb
npm/hosted-git-info@7.0.1	None	`0`	26.7 kB	npm-cli-ops
npm/ip-address@9.0.5	None	`0`	177 kB	beaugunderson
npm/is-builtin-module@3.2.1	None	`0`	3.88 kB	sindresorhus
npm/jackspeak@2.3.6	environment	`0`	253 kB	isaacs
npm/jsbn@1.1.0	None	`0`	46.9 kB	andyperlitch
npm/make-fetch-happen@13.0.1	network	`0`	52.8 kB	npm-cli-ops
npm/minipass-collect@2.0.1	None	`0`	4.96 kB	isaacs
npm/minipass-fetch@3.0.5	environment, network	`0`	46.8 kB	npm-cli-ops
npm/minipass@7.1.2	None	`0`	286 kB	isaacs
npm/node-gyp@10.1.0	environment, shell	`+2`	2.64 MB	lukekarrys
npm/nopt@7.2.1	None	`0`	26.2 kB	npm-cli-ops
npm/normalize-package-data@6.0.0	None	`0`	28.3 kB	npm-cli-ops
npm/npm-install-checks@6.3.0	None	`0`	6.21 kB	npm-cli-ops
npm/npm-package-arg@11.0.1	None	`0`	19.1 kB	npm-cli-ops
npm/npm-pick-manifest@9.0.0	None	`0`	16.4 kB	npm-cli-ops
npm/path-scurry@1.10.1	filesystem	`0`	529 kB	isaacs
npm/proc-log@3.0.0	None	`0`	5.21 kB	lukekarrys
npm/resolve-pkg-maps@1.0.0	None	`0`	15 kB	hirokiosame
npm/spdx-correct@3.2.0	None	`0`	23.4 kB	kemitchell
npm/spdx-expression-parse@4.0.0	None	`0`	12.3 kB	kemitchell
npm/ssri@10.0.6	None	`0`	38.7 kB	npm-cli-ops
npm/string-width-cjs@4.2.3	None	`0`	0 B
npm/strip-ansi-cjs@6.0.1	None	`0`	0 B
npm/ts-api-utils@1.3.0	None	`0`	828 kB	joshuakgoldberg
npm/unique-filename@3.0.0	None	`0`	3.41 kB	lukekarrys
npm/unique-slug@4.0.0	None	`0`	2.58 kB	lukekarrys
npm/uuid@9.0.1	None	`0`	123 kB	ctavan
npm/validate-npm-package-license@3.0.4	None	`0`	16.6 kB	kemitchell
npm/validate-npm-package-name@5.0.0	None	`0`	7.88 kB	lukekarrys
npm/which@4.0.0	environment Transitive: filesystem	`+1`	50.5 kB	npm-cli-ops
npm/wrap-ansi-cjs@7.0.0	None	`0`	0 B

🚮 Removed packages: npm/@es-joy/jsdoccomment@0.37.1, npm/@eslint/eslintrc@1.4.1, npm/@lavamoat/aa@3.1.5, npm/@lavamoat/allow-scripts@2.5.1, npm/@nicolo-ribaudo/semver-v6@6.3.3, npm/@npmcli/fs@2.1.2, npm/@npmcli/promise-spawn@6.0.2, npm/@npmcli/run-script@6.0.2, npm/@types/glob@7.2.0, npm/@types/minimatch@5.1.2, npm/@types/prettier@2.7.1, npm/@typescript-eslint/eslint-plugin@5.42.1, npm/@typescript-eslint/parser@5.62.0, npm/@typescript-eslint/type-utils@5.42.1, npm/abbrev@1.1.1, npm/agentkeepalive@4.5.0, npm/bin-links@4.0.1, npm/cacache@16.1.3, npm/eslint-plugin-es@4.1.0, npm/eslint-plugin-jsdoc@41.1.2, npm/eslint-plugin-mocha@10.1.0, npm/eslint-plugin-n@15.7.0, npm/ip@2.0.1, npm/make-fetch-happen@10.2.1, npm/minipass-collect@1.0.2, npm/minipass-fetch@2.1.2, npm/natural-compare-lite@1.4.0, npm/node-gyp@9.4.1, npm/nopt@6.0.0, npm/read-package-json-fast@3.0.2, npm/regexpp@3.2.0, npm/ssri@9.0.1, npm/typescript@5.1.6, npm/unique-filename@2.0.1, npm/unique-slug@3.0.0, npm/which@3.0.1, npm/yargs@16.2.0

View full report↗︎

socket-security · 2024-03-27T12:30:57Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note
New author	npm/validate-npm-package-name@5.0.0	New Author: lukekarrys Previous Author: gar
Shell access	npm/foreground-child@3.1.1	Module: child_process Location: Package overview
Shell access	npm/foreground-child@3.1.1	Module: child_process Location: Package overview
New author	npm/abbrev@2.0.0	New Author: lukekarrys Previous Author: isaacs
New author	npm/exponential-backoff@3.1.1	New Author: sssayegh Previous Author: coveo-organization
New author	npm/normalize-package-data@6.0.0	New Author: npm-cli-ops Previous Author: lukekarrys
New author	npm/create-jest@29.7.0	New Author: simenb Previous Author: cpojer
Network access	npm/@npmcli/agent@2.2.1	Module: https-proxy-agent Location: Package overview
Network access	npm/@npmcli/agent@2.2.1	Module: net Location: Package overview
Network access	npm/@npmcli/agent@2.2.1	Module: tls Location: Package overview
Network access	npm/@npmcli/agent@2.2.1	Module: dns Location: Package overview
Network access	npm/@npmcli/agent@2.2.1	Module: http-proxy-agent Location: Package overview

View full report↗︎

Next steps

What is new author?

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

What is shell access?

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore npm/validate-npm-package-name@5.0.0
@SocketSecurity ignore npm/foreground-child@3.1.1
@SocketSecurity ignore npm/abbrev@2.0.0
@SocketSecurity ignore npm/exponential-backoff@3.1.1
@SocketSecurity ignore npm/normalize-package-data@6.0.0
@SocketSecurity ignore npm/create-jest@29.7.0
@SocketSecurity ignore npm/@npmcli/agent@2.2.1

Mrtenz · 2024-03-27T12:51:59Z

packages/base/package.json

    "eslint-plugin-import": "~2.26.0",
-    "eslint-plugin-jsdoc": "^39.6.2 || ^41 || ^43.0.7",


I'm not sure why we used this range before, but I replaced it with the latest (Node.js 16-compatible) version. I can revert if there's a good reason to have this range.

cc @legobeat

Context and previous discussion:

typescript: add support for typescript 5.0.x, 5.1.x #288 (comment)

jsdoc: remove deprecated rule jsdoc/newline-after-description #290

peerDeps(base): allow eslint-plugin-jsdoc ^43.0.7 #319

Mrtenz · 2024-03-27T12:59:19Z

packages/base/src/index.js

-    'max-statements-per-line': [
-      'error',
-      {
-        max: 1,
-      },
-    ],


Our validation script was complaining about this being handled by Prettier.

Mrtenz · 2024-03-27T12:59:41Z

packages/base/src/index.js

+    'jsdoc/tag-lines': [
+      'error',
+      'any',
+      {
+        startLines: 1,
+      },
+    ],


AFAIK this matches the previous behaviour, where one line between the description and the first tag is required.

Mrtenz · 2024-03-27T13:00:11Z

packages/typescript/src/index.js

-    // Should be disabled per Prettier
-    '@typescript-eslint/no-extra-semi': 'off',


Our validation script was complaining about this being handled by Prettier.

Mrtenz · 2024-03-27T13:00:44Z

packages/typescript/tsconfig.json

@@ -1,3 +1,6 @@
 {
+  "compilerOptions": {
+    "strictNullChecks": true


This is now required by @typescript-eslint/eslint-plugin when type checking is enabled. I think most of our repos use strict which also enables this anyway.

mcmire · 2024-03-27T18:24:31Z

Thanks so much for doing this work, this is super helpful. I'll try to take a look soon.

Mrtenz · 2024-04-13T09:29:04Z

Bumping to Prettier v3 will require some more changes, so we may want to do that separately.

Jest currently does not support Prettier v3 for snapshots.
auto-changelog and create-release-branch break because the API is now async.
Potentially more issues that I haven't found yet.

kanthesha

LGTM.

packages/base/package.json

mcmire

Question about upgrading Prettier, but everything else looks pretty good to me.

packages/base/package.json

mcmire · 2024-05-28T21:18:52Z

@Mrtenz Ping on this PR when you get a chance.

Mrtenz · 2024-05-29T06:54:14Z

@mcmire @legobeat I reverted the Prettier changes. Unsure what the other decisions are regarding the changes, though.

legobeat

LGTM

mcmire

Looks great!

Mrtenz commented Mar 27, 2024

View reviewed changes

Mrtenz changed the title ~~Bump all ESLint dependencies~~ BREAKING: Bump all ESLint dependencies Mar 27, 2024

Mrtenz marked this pull request as ready for review March 27, 2024 13:03

Mrtenz requested a review from a team as a code owner March 27, 2024 13:03

Mrtenz requested review from mcmire and legobeat March 27, 2024 13:03

Mrtenz force-pushed the mrtenz/bump-dependencies branch from 69a7ea5 to 4eb7750 Compare March 28, 2024 11:35

Mrtenz requested review from a team as code owners March 28, 2024 11:35

Mrtenz removed the request for review from a team March 28, 2024 11:36

kanthesha reviewed Apr 15, 2024

View reviewed changes

legobeat reviewed Apr 15, 2024

View reviewed changes

packages/base/package.json Outdated Show resolved Hide resolved

legobeat reviewed Apr 15, 2024

View reviewed changes

packages/base/package.json Outdated Show resolved Hide resolved

legobeat reviewed Apr 15, 2024

View reviewed changes

packages/base/package.json Outdated Show resolved Hide resolved

mcmire reviewed Apr 18, 2024

View reviewed changes

packages/base/package.json Outdated Show resolved Hide resolved

packages/base/package.json Outdated Show resolved Hide resolved

packages/base/package.json Outdated Show resolved Hide resolved

desi requested a review from a team May 23, 2024 19:18

Mrtenz added 4 commits May 29, 2024 08:47

Bump all ESLint dependencies

9786db8

Update validation script to handle breaking changes

69ba503

Update @typescript-eslint/eslint-plugin recommended rules name

3a82742

Revert Prettier bump

7e7a6f6

Mrtenz force-pushed the mrtenz/bump-dependencies branch from 6cfabce to 7e7a6f6 Compare May 29, 2024 06:48

Mrtenz added 2 commits May 29, 2024 08:50

Revert more Prettier changes

b6b8a97

Update rules snapshot

f704d16

Widen range of eslint-plugin-jsdoc

c512e92

legobeat approved these changes May 29, 2024

View reviewed changes

mcmire approved these changes May 30, 2024

View reviewed changes

Merge branch 'main' into mrtenz/bump-dependencies

7bc6519

mcmire merged commit 7fe37fe into main Jun 4, 2024
15 checks passed

mcmire deleted the mrtenz/bump-dependencies branch June 4, 2024 16:59

legobeat mentioned this pull request Jun 4, 2024

13.0.0 #353

Draft

Mrtenz mentioned this pull request Jun 6, 2024

chore(devdeps): @lavamoat/allow-scripts@^2.3.1->^3.0.4 #354

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BREAKING: Bump all ESLint dependencies #351

BREAKING: Bump all ESLint dependencies #351

Mrtenz commented Mar 27, 2024 •

edited

socket-security bot commented Mar 27, 2024 •

edited

socket-security bot commented Mar 27, 2024 •

edited

Mrtenz Mar 27, 2024

legobeat Apr 15, 2024 •

edited

Mrtenz Mar 27, 2024

Mrtenz Mar 27, 2024

Mrtenz Mar 27, 2024

Mrtenz Mar 27, 2024 •

edited

mcmire commented Mar 27, 2024

Mrtenz commented Apr 13, 2024

kanthesha left a comment

mcmire left a comment

mcmire commented May 28, 2024

Mrtenz commented May 29, 2024

legobeat left a comment

mcmire left a comment

		"eslint-plugin-import": "~2.26.0",
		"eslint-plugin-jsdoc": "^39.6.2 \|\| ^41 \|\| ^43.0.7",

		// Should be disabled per Prettier
		'@typescript-eslint/no-extra-semi': 'off',

BREAKING: Bump all ESLint dependencies #351

BREAKING: Bump all ESLint dependencies #351

Conversation

Mrtenz commented Mar 27, 2024 • edited

Breaking changes

socket-security bot commented Mar 27, 2024 • edited

socket-security bot commented Mar 27, 2024 • edited

Next steps

Mrtenz Mar 27, 2024

Choose a reason for hiding this comment

legobeat Apr 15, 2024 • edited

Choose a reason for hiding this comment

Mrtenz Mar 27, 2024

Choose a reason for hiding this comment

Mrtenz Mar 27, 2024

Choose a reason for hiding this comment

Mrtenz Mar 27, 2024

Choose a reason for hiding this comment

Mrtenz Mar 27, 2024 • edited

Choose a reason for hiding this comment

mcmire commented Mar 27, 2024

Mrtenz commented Apr 13, 2024

kanthesha left a comment

Choose a reason for hiding this comment

mcmire left a comment

Choose a reason for hiding this comment

mcmire commented May 28, 2024

Mrtenz commented May 29, 2024

legobeat left a comment

Choose a reason for hiding this comment

mcmire left a comment

Choose a reason for hiding this comment

Mrtenz commented Mar 27, 2024 •

edited

socket-security bot commented Mar 27, 2024 •

edited

socket-security bot commented Mar 27, 2024 •

edited

legobeat Apr 15, 2024 •

edited

Mrtenz Mar 27, 2024 •

edited