From 78ef052c77e360372cd92fcd3b0ca5f690a2a94b Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Sat, 17 Oct 2026 17:48:47 -0500 Subject: [PATCH 1/3] fix(oxc-plugin): install oxlint-tsgolint 7 to stop flaky TS2307 on macOS oxlint-tsgolint 0.23.0 bundles a typescript-go whose macOS realpath (fcntl F_GETPATH) can lose its buffer under concurrent module resolution, so `rr tsc` fails at random with TS2307 on installed modules (microsoft/typescript-go#4060, fixed in #4178). - install range: ^0.23.0 -> ^7.0.2004, which also matches the >=7.0.2003 peer that current oxlint (installed as ^1.0.0) needs - peer range: >=0.15.0 -> >=0.24.0, so the parity test rejects an install range that includes the broken release - dx devDependencies: 0.23.0 -> 0.25.0, the fixed 0.x that still fits the locked oxlint 1.66 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01V4iz3teZoyUZW9nXnX9RQr --- .changeset/oxc-plugin-tsgolint-realpath.md | 5 ++ package.json | 2 +- pnpm-lock.yaml | 76 +++++++++++----------- run-run/oxc-plugin/package.json | 4 +- run-run/oxc-plugin/src/tool-versions.ts | 2 +- 5 files changed, 47 insertions(+), 42 deletions(-) create mode 100644 .changeset/oxc-plugin-tsgolint-realpath.md diff --git a/.changeset/oxc-plugin-tsgolint-realpath.md b/.changeset/oxc-plugin-tsgolint-realpath.md new file mode 100644 index 00000000..68d76745 --- /dev/null +++ b/.changeset/oxc-plugin-tsgolint-realpath.md @@ -0,0 +1,5 @@ +--- +"@rrlab/oxc-plugin": patch +--- + +`rr plugins add oxc` installs `oxlint-tsgolint@^7.0.2004`, and the peer range now starts at `>=0.24.0`. `oxlint-tsgolint@0.23.0` bundles a typescript-go whose macOS `realpath` can fail under concurrency, so `rr tsc` reports random `TS2307` on installed modules ([microsoft/typescript-go#4060](https://github.com/microsoft/typescript-go/issues/4060)). The new install range also matches the `>=7.0.2003` peer that current `oxlint` requires. diff --git a/package.json b/package.json index dcc734e9..e2839d5a 100644 --- a/package.json +++ b/package.json @@ -27,7 +27,7 @@ "lefthook": "2.1.1", "oxfmt": "^0.73.0", "oxlint": "^1.0.0", - "oxlint-tsgolint": "^0.23.0", + "oxlint-tsgolint": "^0.25.0", "tsdown": "0.22.0", "turbo": "2.11.9", "typescript": "^6.0.3", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5f292400..c8530f61 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -58,10 +58,10 @@ importers: version: 0.73.0 oxlint: specifier: ^1.0.0 - version: 1.50.0(oxlint-tsgolint@0.23.0) + version: 1.50.0(oxlint-tsgolint@0.25.0) oxlint-tsgolint: - specifier: ^0.23.0 - version: 0.23.0 + specifier: ^0.25.0 + version: 0.25.0 tsdown: specifier: 0.22.0 version: 0.22.0(typescript@6.0.3)(unrun@0.2.39) @@ -175,10 +175,10 @@ importers: version: 0.73.0 oxlint: specifier: 1.66.0 - version: 1.66.0(oxlint-tsgolint@0.23.0) + version: 1.66.0(oxlint-tsgolint@0.25.0) oxlint-tsgolint: - specifier: 0.23.0 - version: 0.23.0 + specifier: 0.25.0 + version: 0.25.0 semver: specifier: ^7.8.1 version: 7.8.1 @@ -779,33 +779,33 @@ packages: cpu: [x64] os: [win32] - '@oxlint-tsgolint/darwin-arm64@0.23.0': - resolution: {integrity: sha512-gOs9PVr2wEg4ox9z0aJo+RKhhImW86YL5N6yav8BK/rgPsIrwN/igSZ+pbRr723NFvUNKde9fgMhRA6JrXAOZw==} + '@oxlint-tsgolint/darwin-arm64@0.25.0': + resolution: {integrity: sha512-87opKlwFP8qS9WHAeETV+kA0fC9Oyj4sg7OxWdI4xQY0WC7zlN6BgG66uE5mvtN5mahkt/gL0i/AVEnX6POq2Q==} cpu: [arm64] os: [darwin] - '@oxlint-tsgolint/darwin-x64@0.23.0': - resolution: {integrity: sha512-kjJ8B+7n4tB9VJdxS5A9GdJt6/bYpzbu4lXp2uO1S3sRmCB5gDEABlGoiePNApRWaW+xqL4b4xgiE727jSLhuA==} + '@oxlint-tsgolint/darwin-x64@0.25.0': + resolution: {integrity: sha512-HJmuZexsrhqp4WmETn+Soq7Ogt5F0jirv+cYRSniIPe+d/x5beQzLX69xOLhQRE+8FLGETe7FahWMVP8x0dW4g==} cpu: [x64] os: [darwin] - '@oxlint-tsgolint/linux-arm64@0.23.0': - resolution: {integrity: sha512-6dCZuKNu135seMXilkRk9SpCx6i1XgmiipYGalLij5WVRX6ZYS8c4xI7preN/zv9fCXhsQclTIMDu2Y/cytTjw==} + '@oxlint-tsgolint/linux-arm64@0.25.0': + resolution: {integrity: sha512-aNyYsPREvCJi3qjfBA0sQB7DhT3y/W5Ac2JI2D8IJynoTOAhVZj401Si6901oDajlBWyqJqqojudn0VgHB6+7A==} cpu: [arm64] os: [linux] - '@oxlint-tsgolint/linux-x64@0.23.0': - resolution: {integrity: sha512-3bdilnyA7kmSTjK27rvjIjSxL5SIg3wt7vwNiRkouWB83ytssyKnuGvxSYJxgMEmFpSutzaBzcCUM2jDtPGcgA==} + '@oxlint-tsgolint/linux-x64@0.25.0': + resolution: {integrity: sha512-+60+VjK9Mch3uA5WlTdNHuAm5+WA7wPPjuWdPWlU0F6JJpYpGZXUpO1RPKuFEWsBpNbLcLeJ0LbCJ1doWu58NA==} cpu: [x64] os: [linux] - '@oxlint-tsgolint/win32-arm64@0.23.0': - resolution: {integrity: sha512-j+OEp44SVYiQ+ZD+uttsX7u6L9SvmbbQ77SO1pSFCcJlsVMeCk8qZsjhKfGKuT/jIA+ipOJMVs/+pqUfObBWNw==} + '@oxlint-tsgolint/win32-arm64@0.25.0': + resolution: {integrity: sha512-r53TO+eHp/t53nnUkQJfrYYXODPAxmtf3RUFQG5XsE2hD21IunliOaAdZXP2UwzCx+r/fbNaEelqTaAHcDr57w==} cpu: [arm64] os: [win32] - '@oxlint-tsgolint/win32-x64@0.23.0': - resolution: {integrity: sha512-5MyjFuqf+g8OUPJBSGWHJtmoWnzFJYyOg4To9WMQshZYEWig/vtu7JtJ03VWnzHv9LJkAUeApY0gVCOywFR/iQ==} + '@oxlint-tsgolint/win32-x64@0.25.0': + resolution: {integrity: sha512-vqe66B+gL9HarhyHemdlfC2VWT7eoA+o/ufZ7zT6AGHv64boyDZIJS3U+rpZo+ey4O7wZtiS/vYR2fWqDoFeBw==} cpu: [x64] os: [win32] @@ -1929,8 +1929,8 @@ packages: vite-plus: optional: true - oxlint-tsgolint@0.23.0: - resolution: {integrity: sha512-3mBv3CoPbh8dFbzfDGIWa2ytZjn2v+3EX4aKRXjIhsoGFzG8GCjfRirz3rwZf1wYbZzsNLTSgpw8VjQuWdp/jA==} + oxlint-tsgolint@0.25.0: + resolution: {integrity: sha512-7DBpqyLZCfyoXiivyfzt9Xmju/K1RcN+Y1W7buEwrgRCWWF11v9alypPqWGZBmh2erDkKL/kVyhKUH2Px+t13A==} hasBin: true oxlint@1.50.0: @@ -2675,22 +2675,22 @@ snapshots: '@oxfmt/binding-win32-x64-msvc@0.73.0': optional: true - '@oxlint-tsgolint/darwin-arm64@0.23.0': + '@oxlint-tsgolint/darwin-arm64@0.25.0': optional: true - '@oxlint-tsgolint/darwin-x64@0.23.0': + '@oxlint-tsgolint/darwin-x64@0.25.0': optional: true - '@oxlint-tsgolint/linux-arm64@0.23.0': + '@oxlint-tsgolint/linux-arm64@0.25.0': optional: true - '@oxlint-tsgolint/linux-x64@0.23.0': + '@oxlint-tsgolint/linux-x64@0.25.0': optional: true - '@oxlint-tsgolint/win32-arm64@0.23.0': + '@oxlint-tsgolint/win32-arm64@0.25.0': optional: true - '@oxlint-tsgolint/win32-x64@0.23.0': + '@oxlint-tsgolint/win32-x64@0.25.0': optional: true '@oxlint/binding-android-arm-eabi@1.50.0': @@ -3470,16 +3470,16 @@ snapshots: '@oxfmt/binding-win32-ia32-msvc': 0.73.0 '@oxfmt/binding-win32-x64-msvc': 0.73.0 - oxlint-tsgolint@0.23.0: + oxlint-tsgolint@0.25.0: optionalDependencies: - '@oxlint-tsgolint/darwin-arm64': 0.23.0 - '@oxlint-tsgolint/darwin-x64': 0.23.0 - '@oxlint-tsgolint/linux-arm64': 0.23.0 - '@oxlint-tsgolint/linux-x64': 0.23.0 - '@oxlint-tsgolint/win32-arm64': 0.23.0 - '@oxlint-tsgolint/win32-x64': 0.23.0 - - oxlint@1.50.0(oxlint-tsgolint@0.23.0): + '@oxlint-tsgolint/darwin-arm64': 0.25.0 + '@oxlint-tsgolint/darwin-x64': 0.25.0 + '@oxlint-tsgolint/linux-arm64': 0.25.0 + '@oxlint-tsgolint/linux-x64': 0.25.0 + '@oxlint-tsgolint/win32-arm64': 0.25.0 + '@oxlint-tsgolint/win32-x64': 0.25.0 + + oxlint@1.50.0(oxlint-tsgolint@0.25.0): optionalDependencies: '@oxlint/binding-android-arm-eabi': 1.50.0 '@oxlint/binding-android-arm64': 1.50.0 @@ -3500,9 +3500,9 @@ snapshots: '@oxlint/binding-win32-arm64-msvc': 1.50.0 '@oxlint/binding-win32-ia32-msvc': 1.50.0 '@oxlint/binding-win32-x64-msvc': 1.50.0 - oxlint-tsgolint: 0.23.0 + oxlint-tsgolint: 0.25.0 - oxlint@1.66.0(oxlint-tsgolint@0.23.0): + oxlint@1.66.0(oxlint-tsgolint@0.25.0): optionalDependencies: '@oxlint/binding-android-arm-eabi': 1.66.0 '@oxlint/binding-android-arm64': 1.66.0 @@ -3523,7 +3523,7 @@ snapshots: '@oxlint/binding-win32-arm64-msvc': 1.66.0 '@oxlint/binding-win32-ia32-msvc': 1.66.0 '@oxlint/binding-win32-x64-msvc': 1.66.0 - oxlint-tsgolint: 0.23.0 + oxlint-tsgolint: 0.25.0 p-filter@2.1.0: dependencies: diff --git a/run-run/oxc-plugin/package.json b/run-run/oxc-plugin/package.json index 97fc8a36..cfbafd54 100644 --- a/run-run/oxc-plugin/package.json +++ b/run-run/oxc-plugin/package.json @@ -47,7 +47,7 @@ "@rrlab/cli": "workspace:^", "oxfmt": ">=0.30.0", "oxlint": ">=1.0.0", - "oxlint-tsgolint": ">=0.15.0" + "oxlint-tsgolint": ">=0.24.0" }, "peerDependenciesMeta": { "oxlint-tsgolint": { @@ -60,7 +60,7 @@ "@types/semver": "^7.7.1", "oxfmt": "0.73.0", "oxlint": "1.66.0", - "oxlint-tsgolint": "0.23.0", + "oxlint-tsgolint": "0.25.0", "semver": "^7.8.1" } } diff --git a/run-run/oxc-plugin/src/tool-versions.ts b/run-run/oxc-plugin/src/tool-versions.ts index 99fe5a74..f7d87850 100644 --- a/run-run/oxc-plugin/src/tool-versions.ts +++ b/run-run/oxc-plugin/src/tool-versions.ts @@ -1,5 +1,5 @@ export const TOOL_VERSIONS = { oxlint: { install: "^1.0.0" }, oxfmt: { install: "^0.51.0" }, - "oxlint-tsgolint": { install: "^0.23.0" }, + "oxlint-tsgolint": { install: "^7.0.2004" }, } as const; From 8eea44148e4308ad37057ccceea0dd24179e7599 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Sat, 17 Oct 2026 19:03:41 -0500 Subject: [PATCH 2/3] fix(oxc-plugin): install oxfmt 0.73 to drop the critical tinypool oxfmt up to 0.66.0 pins tinypool 2.1.0, which has two critical advisories (GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr), so every project set up with `rr plugins add oxc` inherited them. 0.73.0 is the latest oxfmt and pins tinypool 2.2.0, matching the devDependency dx already uses. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01V4iz3teZoyUZW9nXnX9RQr --- .changeset/oxc-plugin-tsgolint-realpath.md | 2 ++ run-run/oxc-plugin/src/tool-versions.ts | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.changeset/oxc-plugin-tsgolint-realpath.md b/.changeset/oxc-plugin-tsgolint-realpath.md index 68d76745..e270522e 100644 --- a/.changeset/oxc-plugin-tsgolint-realpath.md +++ b/.changeset/oxc-plugin-tsgolint-realpath.md @@ -3,3 +3,5 @@ --- `rr plugins add oxc` installs `oxlint-tsgolint@^7.0.2004`, and the peer range now starts at `>=0.24.0`. `oxlint-tsgolint@0.23.0` bundles a typescript-go whose macOS `realpath` can fail under concurrency, so `rr tsc` reports random `TS2307` on installed modules ([microsoft/typescript-go#4060](https://github.com/microsoft/typescript-go/issues/4060)). The new install range also matches the `>=7.0.2003` peer that current `oxlint` requires. + +`rr plugins add oxc` installs `oxfmt@^0.73.0`. `oxfmt` up to 0.66.0 pins `tinypool@2.1.0`, which has two critical advisories ([GHSA-5gmw-xhrv-c9v3](https://github.com/advisories/GHSA-5gmw-xhrv-c9v3), [GHSA-85c8-ppgw-ccpr](https://github.com/advisories/GHSA-85c8-ppgw-ccpr)). diff --git a/run-run/oxc-plugin/src/tool-versions.ts b/run-run/oxc-plugin/src/tool-versions.ts index f7d87850..b0de8900 100644 --- a/run-run/oxc-plugin/src/tool-versions.ts +++ b/run-run/oxc-plugin/src/tool-versions.ts @@ -1,5 +1,5 @@ export const TOOL_VERSIONS = { oxlint: { install: "^1.0.0" }, - oxfmt: { install: "^0.51.0" }, + oxfmt: { install: "^0.73.0" }, "oxlint-tsgolint": { install: "^7.0.2004" }, } as const; From e1ced7f50f195dba6796dbb40db5a36375fb89c4 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Sat, 17 Oct 2026 19:06:02 -0500 Subject: [PATCH 3/3] fix(oxc-plugin): raise the oxfmt peer floor to 0.67 oxfmt below 0.67.0 pins tinypool 2.1.0 (two critical advisories). A >=0.67.0 floor makes pnpm warn projects still on a vulnerable oxfmt, and makes the TOOL_VERSIONS parity test reject an install range that includes one, the same way the >=0.24.0 floor does for oxlint-tsgolint. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01V4iz3teZoyUZW9nXnX9RQr --- .changeset/oxc-plugin-tsgolint-realpath.md | 4 +++- run-run/oxc-plugin/package.json | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.changeset/oxc-plugin-tsgolint-realpath.md b/.changeset/oxc-plugin-tsgolint-realpath.md index e270522e..c56c5d0a 100644 --- a/.changeset/oxc-plugin-tsgolint-realpath.md +++ b/.changeset/oxc-plugin-tsgolint-realpath.md @@ -4,4 +4,6 @@ `rr plugins add oxc` installs `oxlint-tsgolint@^7.0.2004`, and the peer range now starts at `>=0.24.0`. `oxlint-tsgolint@0.23.0` bundles a typescript-go whose macOS `realpath` can fail under concurrency, so `rr tsc` reports random `TS2307` on installed modules ([microsoft/typescript-go#4060](https://github.com/microsoft/typescript-go/issues/4060)). The new install range also matches the `>=7.0.2003` peer that current `oxlint` requires. -`rr plugins add oxc` installs `oxfmt@^0.73.0`. `oxfmt` up to 0.66.0 pins `tinypool@2.1.0`, which has two critical advisories ([GHSA-5gmw-xhrv-c9v3](https://github.com/advisories/GHSA-5gmw-xhrv-c9v3), [GHSA-85c8-ppgw-ccpr](https://github.com/advisories/GHSA-85c8-ppgw-ccpr)). +`rr plugins add oxc` installs `oxfmt@^0.73.0`, and the peer range now starts at `>=0.67.0`. `oxfmt` up to 0.66.0 pins `tinypool@2.1.0`, which has two critical advisories ([GHSA-5gmw-xhrv-c9v3](https://github.com/advisories/GHSA-5gmw-xhrv-c9v3), [GHSA-85c8-ppgw-ccpr](https://github.com/advisories/GHSA-85c8-ppgw-ccpr)). + +Both new peer floors exist only to warn about broken or vulnerable versions: if a project is still on `oxlint-tsgolint@0.23.0` or `oxfmt` below 0.67.0, pnpm warns about it when `@rrlab/oxc-plugin` is updated. diff --git a/run-run/oxc-plugin/package.json b/run-run/oxc-plugin/package.json index cfbafd54..9dee3c8e 100644 --- a/run-run/oxc-plugin/package.json +++ b/run-run/oxc-plugin/package.json @@ -45,7 +45,7 @@ }, "peerDependencies": { "@rrlab/cli": "workspace:^", - "oxfmt": ">=0.30.0", + "oxfmt": ">=0.67.0", "oxlint": ">=1.0.0", "oxlint-tsgolint": ">=0.24.0" },