Bump minimatch, @typescript-eslint/eslint-plugin, @typescript-eslint/parser and eslint in /src/native - #130250
Conversation
…parser and eslint Bumps [minimatch](https://github.com/isaacs/minimatch) to 10.2.5 and updates ancestor dependencies [minimatch](https://github.com/isaacs/minimatch), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin), [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) and [eslint](https://github.com/eslint/eslint). These dependencies need to be updated together. Updates `minimatch` from 9.0.3 to 10.2.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.3...v10.2.5) Updates `@typescript-eslint/eslint-plugin` from 6.21.0 to 8.62.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.62.1/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 6.21.0 to 8.62.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.62.1/packages/parser) Updates `eslint` from 8.57.0 to 10.6.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v8.57.0...v10.6.0) --- updated-dependencies: - dependency-name: minimatch dependency-version: 10.2.5 dependency-type: indirect - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.62.1 dependency-type: direct:development - dependency-name: "@typescript-eslint/parser" dependency-version: 8.62.1 dependency-type: direct:development - dependency-name: eslint dependency-version: 10.6.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
github-actions
Bot
added
the
needs-area-label
|
Workflow state for the Holistic Review Orchestrator. {
"version": 5,
"last_dispatched_commit": "77794885d21deadb09ad2d3769859639da0a4f94",
"last_dispatched_base_ref": "main",
"last_dispatched_base_sha": "2526a0e28845e76c59c6c48958a6613b9ffbc62b",
"last_reviewed_commit": "77794885d21deadb09ad2d3769859639da0a4f94",
"last_reviewed_base_ref": "main",
"last_reviewed_base_sha": "2526a0e28845e76c59c6c48958a6613b9ffbc62b",
"last_recorded_worker_run_id": "29679154575",
"review_attempt_commit": "",
"review_attempt_base_ref": "",
"review_attempt_count": 0,
"max_review_attempts": 5,
"review_history_format": "holistic-review-disclosure-v1",
"review_history": [
{
"commit": "77794885d21deadb09ad2d3769859639da0a4f94",
"review_id": 4730526685
}
]
} |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Holistic Review
Motivation: This is a Dependabot PR that bumps minimatch to 10.2.5 and updates the ancestor dev-dependencies that constrain it: @typescript-eslint/eslint-plugin and @typescript-eslint/parser (6.21.0 -> 8.62.1) and eslint (8.57.0 -> 10.6.0), plus the transitive package-lock.json graph in src/native. These are lint/tooling devDependencies for the WebAssembly TypeScript build; they do not affect shipped runtime code.
Approach: The change is confined to src/native/package.json (three version bumps) and the regenerated src/native/package-lock.json. The lockfile update is consistent: resolved URLs remain on the internal pkgs.dev.azure.com/dnceng/public/dotnet-public-npm feed (no new registry.npmjs.org URLs were introduced), the new @typescript-eslint 8.62.1 packages declare eslint peer ranges that include ^10.0.0, and the removed @eslint/eslintrc/@humanwhocodes entries are replaced by the eslint 9/10 @eslint/config-array, @eslint/plugin-kit, etc. The src/native npm graph is consumed only by npm ci + npm run rollup:cmake (per src/native/libs/Common/JavaScript/CMakeLists.txt); the enforced npm run lint build step runs against the separate src/mono/browser/runtime package, so this bump does not gate the CoreCLR-wasm build.
Summary: Mechanically the dependency graph is coherent and scoped to build tooling, so overall risk is low. The one substantive concern is that jumping eslint to 10.x drops the legacy eslintrc format that this directory still uses (src/native/.eslintrc.cjs), which will break the local lint/format scripts here even though it does not break CI. See the inline note on src/native/package.json. Recommend verifying the browser-wasm CI legs (which this repo previously wired up specifically to catch src/native npm changes) are green before merge, and treating the eslint flat-config migration as a follow-up. LGTM aside from the flagged lint-config compatibility gap.
Detailed Findings
See the inline comment on src/native/package.json (eslint 10 vs. legacy .eslintrc.cjs). No other actionable issues found; remaining changes are routine Dependabot lockfile regeneration.
Note
This review was generated by this repository's Holistic Review agentic workflow to complement the built-in Copilot review.
Generated by Holistic Review · 138.2 AIC · ⌖ 10.8 AIC · ⊞ 10K
| "eslint": "8.57.0", | ||
| "@typescript-eslint/eslint-plugin": "8.62.1", | ||
| "@typescript-eslint/parser": "8.62.1", | ||
| "eslint": "10.6.0", |
There was a problem hiding this comment.
The bump to eslint 10.6.0 (from 8.57.0) is a major-version jump that drops support for the legacy eslintrc configuration format. This directory still configures ESLint via src/native/.eslintrc.cjs; ESLint 9 made flat config (eslint.config.js) the default and ESLint 10 removes eslintrc support entirely. As a result the lint and format scripts (lines 17-18) will fail with a "could not find config file" / flat-config error until an eslint.config.js is added.
Severity is low because CI does not run npm run lint for src/native (the CoreCLR wasm build only invokes npm ci + npm run rollup:cmake; the enforced npm run lint step targets the separate src/mono/browser/runtime package). So this does not break the build, but it does silently break the local lint/format developer scripts here. Consider migrating .eslintrc.cjs to flat config as a follow-up, or pinning eslint to ^9 with ESLINT_USE_FLAT_CONFIG=false if a migration is not desired yet.
Bumps minimatch to 10.2.5 and updates ancestor dependencies minimatch, @typescript-eslint/eslint-plugin, @typescript-eslint/parser and eslint. These dependencies need to be updated together.
Updates
minimatchfrom 9.0.3 to 10.2.5Changelog
Sourced from minimatch's changelog.
... (truncated)
Commits
693c82310.2.57953af1do not allow .. to consume drive letter on Windows1caf918lint and format7783ed6ignore docs6d9b356update deps etcc36addb10.2.426b9002docs: add warning about ReDoS3a0d83bfix partial matching of globstar patternsea9484010.2.30873fbaupdate depsInstall script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@typescript-eslint/eslint-pluginfrom 6.21.0 to 8.62.1Release notes
Sourced from @typescript-eslint/eslint-plugin's releases.
... (truncated)
Changelog
Sourced from @typescript-eslint/eslint-plugin's changelog.
... (truncated)
Commits
3ea32f4chore(release): publish 8.62.14ecca6dfix(eslint-plugin): [no-unnecessary-type-assertion] parenthesize object liter...f3a7ec7chore(eslint-plugin-internal): [no-dynamic-tests] restrict where noFormat can...301f350fix(eslint-plugin): [no-unnecessary-boolean-literal-compare] preserve boolean...ebce2d4fix(eslint-plugin): [prefer-optional-chain] use suggestion instead of autofix...54e2857chore(release): publish 8.62.081e4c26feat: remove redundant package.json "files" (#12444)b784054chore: usestableTypeOrderingcompiler option (#12427)aaad718chore(release): publish 8.61.10cc8f35fix(eslint-plugin): [no-unnecessary-template-expression] respect ECMAScript l...Updates
@typescript-eslint/parserfrom 6.21.0 to 8.62.1Release notes
Sourced from @typescript-eslint/parser's releases.
... (truncated)
Changelog
Sourced from @typescript-eslint/parser's changelog.
... (truncated)
Commits
3ea32f4chore(release): publish 8.62.154e2857chore(release): publish 8.62.081e4c26feat: remove redundant package.json "files" (#12444)aaad718chore(release): publish 8.61.116a5b24chore(release): publish 8.61.04f84a69chore(release): publish 8.60.11849b53chore: typecheck using tsgo (#12139)f891c29chore(release): publish 8.60.0ca6ca14chore(release): publish 8.59.448e13c0chore(release): publish 8.59.3Updates
eslintfrom 8.57.0 to 10.6.0Release notes
Sourced from eslint's releases.
... (truncated)
Commits
5d12a0410.6.0f7ca54bBuild: changelog update for 10.6.06a42034ci: run ecosystem tests on main branch (#20891)b1f9106feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981)3dbacdbci: bump actions/checkout from 6 to 7 (#21014)c3abfcachore: correct JSDoc param types in html formatter (#21018)a83683ddocs: Update READMEa832320ci: split ecosystem tests into separate jobs (#21001)6b05784fix: prefer-exponentiation-operator invalid autofix at statement start (#20997)bb9eb2afix: account for shadowedBooleaninno-extra-boolean-cast(#21013)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.