Skip to content
This repository was archived by the owner on Oct 7, 2024. It is now read-only.

devDeps: bump @metamask/eslint-config* to v12#262

Merged
legobeat merged 13 commits intoMetaMask:mainfrom
legobeat:devDeps-eslint
Oct 2, 2023
Merged

devDeps: bump @metamask/eslint-config* to v12#262
legobeat merged 13 commits intoMetaMask:mainfrom
legobeat:devDeps-eslint

Conversation

@legobeat
Copy link
Copy Markdown
Contributor

@legobeat legobeat commented Sep 1, 2023 •
edited
Loading

Description

Combines:

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation for new or updated code as appropriate (note: this will usually be JSDoc)
  • I've highlighted breaking changes using the "BREAKING" category above as appropriate

@legobeat legobeat requested a review from a team as a code owner September 1, 2023 06:38
@legobeat legobeat added the type-dependencies Pull requests that update a dependency file label Sep 1, 2023
@socket-security
Copy link
Copy Markdown

socket-security bot commented Sep 1, 2023 •
edited
Loading

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives Size Publisher
@types/node 16.18.57 None +0 3.52 MB
eslint-plugin-n 15.7.0 filesystem +4 883 kB weiran.zsd
@metamask/eslint-config-jest 11.1.0...12.1.0 None +0/-127 8.72 kB metamaskbot
@metamask/eslint-config-typescript 11.1.0...12.1.0 None +0/-8 18.5 kB metamaskbot
@metamask/eslint-config-nodejs 11.1.0...12.1.0 None +5/-9 978 kB metamaskbot
depcheck 1.4.3...1.4.5 filesystem +15/-14 4.69 MB rumpl
eslint-plugin-jsdoc 40.3.0...41.1.2 None +1/-3 1.73 MB gajus

🚮 Removed packages: @metamask/eslint-config@11.1.0, eslint-plugin-node@11.1.0, jest@29.5.0

@socket-security
Copy link
Copy Markdown

socket-security bot commented Sep 1, 2023 •
edited
Loading

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: global-prefix@1.0.2, resolve-dir@1.0.1, expand-tilde@2.0.2, @types/node@16.18.57

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

@legobeat
Copy link
Copy Markdown
Contributor Author

legobeat commented Sep 1, 2023 

@SocketSecurity ignore builtins@5.0.1
@SocketSecurity ignore eslint-plugin-n@15.7.0

@legobeat
Copy link
Copy Markdown
Contributor Author

legobeat commented Sep 1, 2023 

@SocketSecurity ignore tiny-glob@0.2.9
@SocketSecurity ignore node-watch@0.7.3

filesystem access ok

@legobeat
Copy link
Copy Markdown
Contributor Author

legobeat commented Sep 1, 2023 

@SocketSecurity ignore is-ci@2.0.0
@SocketSecurity ignore globalyzer@0.1.0
@SocketSecurity ignore buffer@5.7.1
@SocketSecurity ignore object-assign@4.1.1
@SocketSecurity ignore globrex@0.1.2
@SocketSecurity ignore base64-js@1.5.1
@SocketSecurity ignore ieee754@1.2.1

unmaintained ok

@legobeat legobeat force-pushed the devDeps-eslint branch 2 times, most recently from febb2e6 to b48a16d Compare September 1, 2023 07:25
@legobeat legobeat requested a review from a team September 1, 2023 07:28
@legobeat legobeat changed the title devDeps: bump @metamask/eslint-config* to ^12.1.0 devDeps: bump @metamask/eslint-config* to v12 Sep 25, 2023
@legobeat
Copy link
Copy Markdown
Contributor Author

legobeat commented Sep 25, 2023 

@SocketSecurity ignore global-prefix@1.0.2
@SocketSecurity ignore resolve-dir@1.0.1
@SocketSecurity ignore expand-tilde@2.0.2

new author ok

@legobeat legobeat requested review from a team and mcmire September 25, 2023 22:27
@legobeat legobeat force-pushed the devDeps-eslint branch 2 times, most recently from 55be213 to caf42dd Compare September 30, 2023 02:46
jiexi
jiexi reviewed Oct 2, 2023
View reviewed changes
package.json
"resolutions": {
"ink": "3.1.0",
"react-reconciler": "0.24.0"
},
Copy link
Copy Markdown
Member

@jiexi jiexi Oct 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are these being forced?

Copy link
Copy Markdown
Contributor Author

@legobeat legobeat Oct 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Higher versions introduce peerDependency on newer version of react. You can try to omit 4bab13d and run the suite locally to verify.

Copy link
Copy Markdown
Member

@jiexi jiexi Oct 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ink 3.2.0 has peer deps for "react": ">=16.8.0" and only devDeps for react 17. So it should be fine??

I see why react-reconciler must be in the resolutions though

Copy link
Copy Markdown
Contributor Author

@legobeat legobeat Oct 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ink depends on react-reconciler: ^0.26.2, hence getting dragged down with it here.

Copy link
Copy Markdown
Member

@jiexi jiexi Oct 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't "react-reconciler": "0.24.0" already force the version of react-reconcile in ink? No big deal, just trying to understand if I had a wrong assumption of how the resolution works in yarn. Going to approve

This was referenced Oct 2, 2023
Closed
Closed
Closed
Closed
jiexi
jiexi previously approved these changes Oct 2, 2023
View reviewed changes
@legobeat
Copy link
Copy Markdown
Contributor Author

legobeat commented Oct 2, 2023 

@SocketSecurity ignore @types/node@16.18.57

dependabot bot added 2 commits October 3, 2023 07:54
@dependabot @legobeat
Bump @metamask/eslint-config from 11.1.0 to 12.1.0
64ef701 
Bumps [@metamask/eslint-config](https://github.com/MetaMask/eslint-config) from 11.1.0 to 12.1.0.
- [Release notes](https://github.com/MetaMask/eslint-config/releases)
- [Commits](MetaMask/eslint-config@v11.1.0...v12.1.0)

---
updated-dependencies:
- dependency-name: "@metamask/eslint-config"
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @legobeat
Bump @metamask/eslint-config-jest from 11.1.0 to 12.1.0
9153a46 
Bumps [@metamask/eslint-config-jest](https://github.com/MetaMask/eslint-config) from 11.1.0 to 12.1.0.
- [Release notes](https://github.com/MetaMask/eslint-config/releases)
- [Commits](MetaMask/eslint-config@v11.1.0...v12.1.0)

---
updated-dependencies:
- dependency-name: "@metamask/eslint-config-jest"
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot bot and others added 11 commits October 3, 2023 07:54
@dependabot @legobeat
Bump @metamask/eslint-config-nodejs from 11.1.0 to 12.1.0
21abe98 
Bumps [@metamask/eslint-config-nodejs](https://github.com/MetaMask/eslint-config) from 11.1.0 to 12.1.0.
- [Release notes](https://github.com/MetaMask/eslint-config/releases)
- [Commits](MetaMask/eslint-config@v11.1.0...v12.1.0)

---
updated-dependencies:
- dependency-name: "@metamask/eslint-config-nodejs"
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @legobeat
Bump @metamask/eslint-config-typescript from 11.1.0 to 12.1.0
d0b26cc 
Bumps [@metamask/eslint-config-typescript](https://github.com/MetaMask/eslint-config) from 11.1.0 to 12.1.0.
- [Release notes](https://github.com/MetaMask/eslint-config/releases)
- [Commits](MetaMask/eslint-config@v11.1.0...v12.1.0)

---
updated-dependencies:
- dependency-name: "@metamask/eslint-config-typescript"
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@legobeat
Align peerDeps
a6a08b2
@legobeat
lint:fix
2903959
@legobeat
bump devDeps
fe398b4
@legobeat
align peerDeps
e6eedbb
@legobeat
devDeps: add devDeps to satisfy constraints
9654b4d
@legobeat
pin devDeps in resolution to resolve react requirements
7c91be3
@legobeat
devDeps: add @yarnpkg packages to satisfy constraints
ec85606
@legobeat
yarn dedupe
082a2c1
@legobeat
devDeps: @metamask/eslint-config@^12.1.0->^12.2.0
f555c63
@legobeat legobeat requested a review from jiexi October 2, 2023 22:56
@legobeat legobeat merged commit 4c785f4 into MetaMask:main Oct 2, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@mcmire mcmire Awaiting requested review from mcmire

1 more reviewer

@jiexi jiexi jiexi approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

type-dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@legobeat @jiexi