Repository navigation
feat!: eslint-plugin-import-x 4.18 with its barrel-file rules on; patch minimatch and zod - #17
Merged
Merged
Conversation
…ch minimatch and zod eslint-plugin-import-x 4.18.1 is the first to accept minimatch 11, which fixes GHSA-g3hv-75wg-m249 (Dependabot #6; 4.17.1 imports minimatch's `makeRe`, which 11 removed). minimatch is overridden to ^11.0.1, since eslint and typescript-eslint still ask for ^10, and zod to ^4.6.6 (GHSA-mrhx-c7xc-m3w5, through knip and @angular/forms). pnpm audit: no known vulnerabilities. 4.18's four new rules are on as `error`: - avoid-barrel-files: a module that mostly re-exports others makes every importer load all of them. - avoid-importing-barrel-files: the same through an import, dependencies included. - avoid-namespace-import: `import * as x` hides which exports are used and defeats tree-shaking. - avoid-re-export-all: `export * from` makes a module's API whatever another module exports. To meet them: - The rule tables name their object (`const rules = {...}; export default rules;`): the rule counted the properties of `export default {...}` as exports. The rules are unchanged; rules:add still appends before `});`. - BREAKING: `@devenvy/code-guidelines/eslint` exports `createConfig` only. The layer builders and normalizeOptions are no longer re-exported. The README documents only createConfig, and no known consumer imports anything else. - scripts/rules-add.mjs imports Prettier's `format` and `resolveConfig` by name. 4.18's `order` now puts parent imports before sibling ones when they share a group, as ours do (un-ts/eslint-plugin-import-x#517): the old comparator wasn't transitive, so a file could pass on one Node version and fail on another. Consumers whose imports followed the old order get autofixable import-x/order reports. A new plain-js fixture pins the order. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
ryan-morris
added a commit
to devenvy/ffmpeg-build
that referenced
this pull request
Nov 10, 2026
…g-m249) (#129) ## Summary Follow-up to #128. It closes **Dependabot alert #1** and **code-scanning alert #88** (Scorecard's "Vulnerabilities" check counts the same advisory, so #88 clears on its first run after this merges). - **minimatch < 11.0.1** (GHSA-g3hv-75wg-m249, a DoS through globparts amplification) came in only through dev tooling: eslint 10.14.0, `@eslint/config-array` and typescript-eslint, which still ask for `^10`. 10.x has no fix, so `pnpm-workspace.yaml` overrides it to `^11.0.1` (resolves to 11.0.5), with a note to drop the override once they allow 11. The published package's runtime dependencies (commander, yaml, zod) don't include minimatch. - **That needed `@devenvy/code-guidelines` 4.0.0** (devenvy/code-guidelines-ecma#17). Its eslint-plugin-import-x 4.18 works with minimatch 11; 4.17 imported `makeRe`, which 11 removed. - `pnpm audit`: no known vulnerabilities. ## What code-guidelines 4.0.0 asked for - **`import-x/order`**: parent imports (`../x`) now come before sibling ones (`./y`) in the shared relative group. The old comparator wasn't transitive, so the result could depend on the Node version (un-ts/eslint-plugin-import-x#517). `eslint --fix` reordered 106 imports in 78 files. Checked file by file: apart from the files below, each changed file holds exactly the same lines as before, only reordered. - **`import-x/avoid-barrel-files`**: `src/cli-errors.ts` re-exported `CliError`, `EXIT_PROBLEM`, `EXIT_USAGE` and `ExitCode` from `cli-error.ts`. Its six importers take them from `cli-error.ts` now, and the re-exports are gone. ## Testing - `guidelines:check`, `lint`, `format:check`, `typecheck`, `knip`: pass. - `test:ci`: 197 files, 4705 tests pass. - **Timing note:** in one full run, a `tests/driver.test.ts` test hit its 60 s timeout and then passed on re-run. It isn't caused by this change: on `main`, its two slowest tests take 58 s and 55.5 s, close to the limit, and are equally slow there. Left for a separate fix. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes Dependabot alert #6 (minimatch, GHSA-g3hv-75wg-m249) here, and unblocks the same fix in devenvy/ffmpeg-build (#128), where a minimatch 11 override crashed lint.
Dependencies
makeRe, which minimatch 11 removed. 4.18.1 is the first release that accepts^11.0.1.pnpm-workspace.yaml.minimatch@<11.0.1 → ^11.0.1: eslint 10.14.0,@eslint/config-arrayand typescript-eslint still ask for^10, and 10.x has no fix. Drop the override once they allow 11.zod@<4.6.6 → ^4.6.6(GHSA-mrhx-c7xc-m3w5, high): through knip and@angular/forms, whose ranges already allow the fix.pnpm audit: no known vulnerabilities.import-x 4.18's four new rules, all on as
erroravoid-barrel-filesavoid-importing-barrel-fileslodash-esvslodash-es/debounce)avoid-namespace-importimport * as xavoid-re-export-allexport * fromexport *pass silentlyTo meet them, with no exceptions or disables:
const rules = {...}; export default rules;). The rule counted the properties ofexport default {...}as exports. The rules themselves are unchanged, andrules:addstill appends before});(it finds the table's last line starting with}).@devenvy/code-guidelines/eslintexportscreateConfigonly. It no longer re-exports the layer builders (angular,ignores,imports,javascript,prettier,typescript,vitest) ornormalizeOptions. The README documents onlycreateConfig. Every known consumer imports only that: devenvy/ffmpeg-build and this repository's owneslint.config.mjs. The tests import the layers from their own modules. Release as 4.0.0.scripts/rules-add.mjsimports Prettier'sformatandresolveConfigby name.Import order change consumers will see
In 4.18,
orderputs parent imports (../x) before sibling ones (./y) when they share a group, as['parent', 'sibling', 'index']does here: un-ts/eslint-plugin-import-x#517. The old comparator wasn't transitive, so a file could pass on Node 24 and fail on Node 26 with no change. Upstream eslint-plugin-import fixed it the same way. Consumers whose imports followed the old order getimport-x/orderreports, all autofixable (eslint --fix): devenvy/ffmpeg-build has 106. A new plain-js fixture (nested/) pins the order.Testing
lint,typecheck,knip,format:check,guidelines:check: pass.pnpm test, pack test included: 11 files, 142 tests pass.check:package(publint, are-the-types-wrong): no new findings.error(2) in all five configurations.import-x/orderreports (autofixable) and 1avoid-barrel-files(src/cli-errors.ts), to be fixed there in #128 once this is released.🤖 Generated with Claude Code