Repository navigation
chore(deps): make every package current (round 2) and make the JS lint gate run - #496
Merged
Merged
Conversation
The only NuGet pin still behind after #495: AWS published 4.0.102.20 since. A re-audit of all 88 central pins against nuget.org reports nothing else behind except SixLabors.ImageSharp 3.2.0 -> 4.1.3, which stays where it is - it is the transitive pin that keeps OrchardCore 3.0.1 on a patched 3.x (GHSA-gwg2-r3hj-4w44), and a major bump there is an API break for a package we only pin for the advisory. The two Aspire projects bypass central management and carry inline versions; all of those are already the latest stable (Aspire.AppHost.Sdk / Aspire.Hosting / Aspire.Hosting.AppHost 13.6.4, KubernetesClient 21.0.8, MessagePack 3.1.12, Microsoft.SourceLink.GitHub 10.0.403), as is Microsoft.Data.Sqlite 10.0.14 in Directory.Build.props. Verified: SharpCoreDB.CI.slnf restores and builds Release with 0 errors; the four CI suites 2.118 + 255 + 116 + 24 with 0 failures; the OrchardCore example - the only project that references AWSSDK.Core - builds with 0 errors.
…ake lint run After #495 the JS client was current within its ranges but seven packages still sat a major behind: jest 29.7 -> 30.5, @types/jest 29 -> 30, tsup 8.5 -> 9.0, @types/node 20 -> 26, eslint 8.57 -> 10.14, @typescript-eslint 8.0 -> 8.72 and google-protobuf 3.21 -> 4.0. `npm run lint` did not run at all on master: the project had no ESLint configuration, so `eslint src/**/*.ts` exited 2 with "ESLint couldn't find a configuration file". ESLint 10 reads flat config only, so the fix is `eslint.config.js` at the parser-only baseline - TypeScript sources parsed, no rules enabled - which makes the script execute (exit 0) without inventing a rule set for sources that use `any` deliberately at the protocol boundary. Enabling rules is a policy decision, not a dependency bump, and is left to the owner. google-protobuf is listed as a tsup `external` but imported by nothing in src/, so the 3 -> 4 bump is inert for this package's own behaviour; it was taken because a stale declared major is a trap for the next consumer of it. typescript stays on 5.9: the latest tag is 7.0.2, which is not a version bump to take blindly - TS 7 is the native-compiler line and needs its own migration. Verified: `npm run lint` exit 0 (was exit 2), tsc --noEmit 0 errors, tsup build OK for cjs/esm/dts, jest 16/16. `npm audit --omit=dev` is 0; the 27 dev-only advisories all trace to one root, minimatch's globparts DoS, which has no in-range fix - npm's own suggestion is a downgrade to @typescript-eslint 6.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round 2: everything current
Re-audited all 88 central NuGet pins against nuget.org and the JS client against npm after #495 merged.
NuGet —
chore(deps): AWSSDK.Core 4.0.102.19 -> 4.0.102.20The only pin behind. Everything else is current, including the two Aspire projects that carry inline versions (13.6.4 / KubernetesClient 21.0.8 / MessagePack 3.1.12 / SourceLink 10.0.403) and
Microsoft.Data.Sqlite10.0.14 inDirectory.Build.props.SixLabors.ImageSharp3.2.0 → 4.1.3 is the one deliberate hold: it is the transitive pin keeping OrchardCore 3.0.1 on a patched 3.x, and a major bump is an API break for a package we only pin for the advisory.JS client —
chore(client-js): take the dev toolchain to its current majors, and make lint runSeven majors taken:
jest29→30,@types/jest29→30,tsup8→9,@types/node20→26,eslint8→10,@typescript-eslint8.0→8.72,google-protobuf3→4.npm run lintwas broken on master — no ESLint config existed, so it exited 2 with "ESLint couldn't find a configuration file". ESLint 10 is flat-config only, so this addseslint.config.jsat the parser-only baseline (sources parsed, no rules enabled). The script now exits 0. Enabling a rule set is a policy decision, not a dependency bump, so it is left to the owner.typescriptstays on 5.9 — the latest tag is 7.0.2, which is the native-compiler line and needs its own migration, not a version bump.Verification
SharpCoreDB.CI.slnfrestore + Release buildnpm run linttsc --noEmit/tsup build/jestnpm audit --omit=devdotnet list package --outdated(CI filter)Known/dev-only leftovers
minimatchglobparts DoS,deepmerge); no in-range fix — npm's own suggestion is a downgrade.Microsoft.NETCore.App.Runtime.*(rc.1 runtime pack). The fix isglobal.json→ rc.3, which is a standing rail I have not touched; it needs the owner's word.