[botandbang]

Four commits: one per part, then the lint rule.

fetchindex no longer loads core's optionsParser

• Removes the "versions should work with optionsParser" tests from fetchindex/test/test.js. They passed core's optionsParser output to fetchindex, which repeated the two tests above them with the same options: the global fetch or undici's, and the same index URL. Core doesn't use fetchindex, so nothing else covered them.
• Removes fetchindex's luxon devDependency. It was only there because optionsParser requires luxon and CI installs just the workspace under test.
• Removes the fetchindex exception from knip.jsonc.

static's build test stops the clock without core's luxon

• static/test/test.build.js stubs Date.now in the build's child process instead of setting Settings.now on core's copy of luxon, which it found with require.resolve('luxon', { paths: [core] }). luxon's default clock is () => Date.now(), so core sees the same time.
• Removes the static exception from knip.jsonc.
• Removes @types/luxon from the root devDependencies. Once static stopped resolving luxon, knip reported it as unused. Core lists @types/luxon itself, so it's still installed and npm run types produces the same output.

A private fixtures workspace holds what the tests share

Adds fixtures/ as the workspace @nodevu/fixtures, with "private": true so it's never published (release.yml lists the published packages by name, and this isn't one of them). It holds:

• data/index.json, data/schedule.json and data/now.json, moved from core/test/data/static/.
• index.js, which exports at(), moved from core/util/dev/fixtures.js. ranges/test/fixtures.js had its own copy that differed only by defaulting the date to 2025-09-01, so at() now takes that default and the copy is gone. ranges/test/fixtures.js keeps versionPattern and passes at through.
• beforeEachTemplate.js, moved from core/util/dev/, which core's network-mocking tests use.
• The snapshot refresh scripts, moved from core/util/dev/ to fixtures/util/ along with write.js. npm run test:update -w fixtures replaces npm run test:update -w core, and the scripts write to fixtures/data/.
• The tests for all of the above, moved from core/test/dev-*.js to fixtures/test/, plus one for the new default date. Its coverage is 100%.

core, newest, oldest, parsefiles, ranges, static and translate list @nodevu/fixtures as a devDependency and require it by name (@nodevu/fixtures, @nodevu/fixtures/beforeEachTemplate, @nodevu/fixtures/data/*.json). No test requires a path in another package's folder now. That includes translate's tests, which used to load ranges/test/fixtures.js.

CI's changed-package filter adds fixtures/** to every package that uses it and gives fixtures its own entry, so its tests run in the coverage matrix. The README says where the shared snapshot lives and how to refresh it.

A lint rule keeps it that way

Adds tools/oxlint/nodevu/, the repo's own oxlint JS plugin, loaded from .oxlintrc.json next to the vendored anti-slop one. Its nodevu/no-cross-package-paths rule reports a require(), require.resolve(), import, export ... from or import() whose path is written out in full and resolves into a different package's folder than the file's own. A package is the nearest folder with a package.json, so the repo root counts as one too. Paths built at runtime, like require(`../build/${name}`), aren't checked. oxlint's own no-restricted-imports only looks at ESM import, so it can't do this for CommonJS. eslint-plugin-import-x's no-relative-packages would need eslint as a peer.

npm run lint:rules tests the rule with oxlint's RuleTester (22 cases, 100% of the plugin's lines and branches under c8) and runs as part of npm run lint. With the rule on, putting back fetchindex's old require('../../core/util/prod/optionsParser') fails oxlint. The rule also found translate/examples/default.js requiring ../../ranges, which now requires @nodevu/ranges (already a translate devDependency). The README mentions the rule.

Checked with npm run lint (oxlint with the new rule, oxfmt, docov, harden, the rule's tests, knip), npm run types (committed types unchanged), npm run coverage (100% in all 10 packages with coverage) and npm run docs. Each package's CI test job (npm ci -w <package> then npm run coverage -w <package>) also passes on its own in a clean copy, fixtures included.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​nodevu/​fixtures@​0.0.0	N/A	N/A	N/A	N/A	N/A

View full report