chore(deps-dev): bump the npm-root group with 8 updates - #280
Open
dependabot[bot] wants to merge 14 commits into
Open
chore(deps-dev): bump the npm-root group with 8 updates#280dependabot[bot] wants to merge 14 commits into
dependabot[bot] wants to merge 14 commits into
Conversation
dependabot
Bot
added
dependencies
Bundle ReportChanges will decrease total bundle size by 101 bytes (-0.0%) ⬇️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: viper-frontend-esmAssets Changed:
Files in
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #280 +/- ##
==========================================
+ Coverage 50.09% 50.11% +0.02%
==========================================
Files 998 1000 +2
Lines 58370 58424 +54
Branches 5858 5867 +9
==========================================
+ Hits 29239 29280 +41
- Misses 28228 28235 +7
- Partials 903 909 +6
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Bumps the npm-root group with 8 updates: | Package | From | To | | --- | --- | --- | | [@double-great/stylelint-a11y](https://github.com/double-great/stylelint-a11y) | `3.4.15` | `3.5.0` | | [eslint](https://github.com/eslint/eslint) | `10.5.0` | `10.8.0` | | [fallow](https://github.com/fallow-rs/fallow) | `2.102.0` | `3.6.0` | | [jscpd](https://github.com/kucherenko/jscpd/tree/HEAD/rust/jscpd) | `5.0.10` | `5.0.12` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.56.0` | `0.60.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.71.0` | `1.75.0` | | [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) | `0.23.0` | `0.25.0` | | [stylelint](https://github.com/stylelint/stylelint) | `17.13.0` | `17.14.1` | Updates `@double-great/stylelint-a11y` from 3.4.15 to 3.5.0 - [Release notes](https://github.com/double-great/stylelint-a11y/releases) - [Changelog](https://github.com/double-great/stylelint-a11y/blob/main/CHANGELOG.md) - [Commits](double-great/stylelint-a11y@v3.4.15...v3.5.0) Updates `eslint` from 10.5.0 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.5.0...v10.8.0) Updates `fallow` from 2.102.0 to 3.6.0 - [Release notes](https://github.com/fallow-rs/fallow/releases) - [Changelog](https://github.com/fallow-rs/fallow/blob/main/CHANGELOG.md) - [Commits](fallow-rs/fallow@v2.102.0...v3.6.0) Updates `jscpd` from 5.0.10 to 5.0.12 - [Release notes](https://github.com/kucherenko/jscpd/releases) - [Changelog](https://github.com/kucherenko/jscpd/blob/master/CHANGELOG.md) - [Commits](https://github.com/kucherenko/jscpd/commits/v5.0.12/rust/jscpd) Updates `oxfmt` from 0.56.0 to 0.60.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.60.0/npm/oxfmt) Updates `oxlint` from 1.71.0 to 1.75.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.75.0/npm/oxlint) Updates `oxlint-tsgolint` from 0.23.0 to 0.25.0 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v0.23.0...v0.25.0) Updates `stylelint` from 17.13.0 to 17.14.1 - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](stylelint/stylelint@17.13.0...17.14.1) --- updated-dependencies: - dependency-name: "@double-great/stylelint-a11y" dependency-version: 3.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-root - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-root - dependency-name: fallow dependency-version: 3.6.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-root - dependency-name: jscpd dependency-version: 5.0.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-root - dependency-name: oxfmt dependency-version: 0.60.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-root - dependency-name: oxlint dependency-version: 1.75.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-root - dependency-name: oxlint-tsgolint dependency-version: 0.25.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-root - dependency-name: stylelint dependency-version: 17.14.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-root ... Signed-off-by: dependabot[bot] <support@github.com>
- oxlint 1.75.0 raised its peer range to oxlint-tsgolint >=7.0.2001, but the grouped update left it at ^0.25.0, so npm install failed with ERESOLVE - npm ci resolves straight from the lockfile and stayed green, so CI never surfaced the break
- $q.dialog() returns a DialogChainObject, not a Promise, so awaiting it resolved immediately instead of waiting for the user - the catch block handling Cancel was therefore unreachable and the deletion ran regardless of which button was clicked - gate on the onOk/onCancel callbacks so Cancel aborts the delete
- mocks $q.dialog as a chainable DialogChainObject so a regression back to awaiting it directly fails the cancel case - verified the cancel test fails against the pre-fix code
- .assignment-item and its .text-body2 descendant in ScheduleView are applied by no template in the codebase - .opacity-60 in ClinicalSchedulerHome appears only in its own declaration - verified each against markup, dynamic class bindings, and Vue's scoped-style-applies-to-child-root behavior
- clears all 84 errors across 23 suites; the rule is enforced at error level but predates these files - bare mocks take the (...args: unknown[]) => unknown form already used in clinician-selector-basic - five Effort dialog suites read mock return values, so they keep an `any` return to preserve the inference bare vi.fn() gave them - the structuredClone mock casts back to its generic signature
- drop 18 unreferenced, non-exported type declarations; services keep their own local copies, so nothing outside the files could reach them - api-responses.ts reduces to ApiError, the only symbol anything imports - quote 7 describe() titles that passed an identifier instead of a string - convert 3 top-level test helpers to const arrows for no-implicit-globals - takes VueApp from 27 lint errors to 1
- the guard could never be false, so the test always returned early on a tautological expect(true) and never reached its real assertion - verified the assertion now fails when a V3 year is selected
- api-responses.ts held only ApiError once its unused DTOs were removed, so the filename no longer described the contents - TypedApiResult already depended on ApiError; co-locating them removes the last import edge between the two files
- brace-expansion 5.0.7 -> 5.0.9 (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895) - fast-uri 3.1.4 -> 3.1.5 (GHSA-7p8r-x3mc-p8w7) - minimatch 10.2.5 -> 10.2.6 raises the brace-expansion floor - both fixes are newer than the .npmrc min-release-age=7 gate, so this used a one-off --min-release-age=0; maintainers, repos and licences verified unchanged against the superseded versions first - npm audit now reports 0 vulnerabilities
- the default toSorted() is lexicographic, so the primary-evaluator warning listed weeks as "1, 10, 2" - covers the remaining type-aware findings: void on deliberately ignored promises, ! over redundant assertions, and a typed catch parameter - ViperFetch passed a non-string into handleError(error: string) and relied on implicit stringification; String() keeps that output
- keeps the type-aware rules that catch real defects (no-floating-promises, await-thenable, no-misused-promises, require-array-sort-compare) - switches off the stylistic ones: prefer-readonly-parameter-types is unsatisfiable against vue-router callback signatures, and strict-boolean-expressions contradicts documented vue-router idioms - no-unnecessary-type-assertion stays off pending an upstream false-positive regression - the typescript plugin also brings ~1,550 syntactic findings the repo never opted into, so those rules are disabled explicitly - no-void is off because no-floating-promises prescribes void as its fix
rlorenzo
force-pushed
the
dependabot/npm_and_yarn/npm-root-8a8f6609e1
branch
from
August 5, 2026 07:35
a08eede to
323e14b
Compare
Contributor
|
@coderabbitai full review |
Contributor
✅ Action performedFull review finished. |
Contributor
📝 WalkthroughWalkthroughThis PR enables type-aware Oxlint rules, updates code and tests to satisfy the new TypeScript checks, removes unused types and styles, relocates ChangesType-aware lint rollout
Clinical Scheduler bulk deletion confirmation flow
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@VueApp/src/ClinicalScheduler/composables/use-bulk-deletion.ts`:
- Around line 105-108: Remove the duplicated second numeric-sort comment in the
bulk-deletion logic, keeping one concise comment that explains why numeric
comparison is required for week numbers.
In `@VueApp/src/ClinicalScheduler/composables/use-permission-checks.ts`:
- Around line 25-33: Update goToClinicianView and goToRotationView, along with
the nearby navigation helper, to handle rejected router.push promises instead of
discarding them with void. Attach the application’s established rejection
handling or await and catch each navigation, preserving the existing destination
paths.
- Around line 25-33: Update goToClinicianView and goToRotationView, along with
the nearby ClinicalScheduler navigation helper, to preserve the configured
VITE_VIPER_HOME base when constructing navigation targets. Prefer the named
routes ClinicalSchedulerHome, ClinicianSchedule, and RotationSchedule so router
base handling remains intact.
In `@VueApp/src/Effort/__tests__/course-add-dialog.test.ts`:
- Line 12: Replace the `any` return types on the Effort service mock
declarations with checked types so the mock boundary stays type-safe: update
`mockCreateCourse` in
VueApp/src/Effort/__tests__/course-add-dialog.test.ts#L12-L12,
`mockUpdateCourse` and `mockUpdateCourseEnrollment` in
VueApp/src/Effort/__tests__/course-edit-dialog.test.ts#L12-L13,
`mockSearchBannerCourses` and `mockImportCourse` in
VueApp/src/Effort/__tests__/course-import-dialog.test.ts#L13-L14, all four
course relationship mocks in
VueApp/src/Effort/__tests__/course-link-dialog.test.ts#L12-L15, and
`mockGetPreview` plus `mockCommitHarvest` in
VueApp/src/Effort/__tests__/harvest-dialog.test.ts#L13-L14. Use the
corresponding service-specific return types where available, and use `unknown`
only for mocks that must remain generic.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f0a85a2c-d4b8-4276-bfaf-9a3f0c70b075
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.json
📒 Files selected for processing (55)
.oxlintrc.jsonVueApp/src/CMS/__tests__/use-url-filtered-table.test.tsVueApp/src/CMS/composables/use-url-filtered-table.tsVueApp/src/CTS/__tests__/assessment-bubble.test.tsVueApp/src/CTS/types/index.tsVueApp/src/ClinicalScheduler/__tests__/clinical-scheduler-home-qa.test.tsVueApp/src/ClinicalScheduler/__tests__/clinical-scheduler-home.test.tsVueApp/src/ClinicalScheduler/__tests__/normalize-schedule-semesters.test.tsVueApp/src/ClinicalScheduler/__tests__/normalize-week.test.tsVueApp/src/ClinicalScheduler/__tests__/permissions-store-computed.test.tsVueApp/src/ClinicalScheduler/__tests__/permissions-store-error-handling.test.tsVueApp/src/ClinicalScheduler/__tests__/permissions-store-utilities.test.tsVueApp/src/ClinicalScheduler/__tests__/rotation-selector-api.test.tsVueApp/src/ClinicalScheduler/__tests__/rotation-selector.test.tsVueApp/src/ClinicalScheduler/__tests__/test-utils.tsVueApp/src/ClinicalScheduler/__tests__/use-bulk-deletion.test.tsVueApp/src/ClinicalScheduler/__tests__/use-optimistic-schedule-updates.test.tsVueApp/src/ClinicalScheduler/components/ScheduleView.vueVueApp/src/ClinicalScheduler/composables/use-bulk-deletion.tsVueApp/src/ClinicalScheduler/composables/use-optimistic-schedule-updates.tsVueApp/src/ClinicalScheduler/composables/use-permission-checks.tsVueApp/src/ClinicalScheduler/pages/ClinicalSchedulerHome.vueVueApp/src/ClinicalScheduler/services/error-transformer.tsVueApp/src/ClinicalScheduler/types/api-responses.tsVueApp/src/ClinicalScheduler/types/api.tsVueApp/src/ClinicalScheduler/types/index.tsVueApp/src/Effort/__tests__/course-add-dialog.test.tsVueApp/src/Effort/__tests__/course-edit-dialog.test.tsVueApp/src/Effort/__tests__/course-import-dialog.test.tsVueApp/src/Effort/__tests__/course-link-dialog.test.tsVueApp/src/Effort/__tests__/course-service.test.tsVueApp/src/Effort/__tests__/dashboard-service.test.tsVueApp/src/Effort/__tests__/effort-records-table.test.tsVueApp/src/Effort/__tests__/harvest-dialog.test.tsVueApp/src/Effort/__tests__/instructor-add-dialog.test.tsVueApp/src/Effort/__tests__/instructor-edit-dialog.test.tsVueApp/src/Effort/__tests__/instructor-service.test.tsVueApp/src/Effort/__tests__/report-service.test.tsVueApp/src/Effort/__tests__/use-report-url-params.test.tsVueApp/src/Effort/composables/use-report-url-params.tsVueApp/src/Effort/services/harvest-service.tsVueApp/src/Effort/types/harvest-types.tsVueApp/src/Students/EmergencyContact/__tests__/completeness-icon.test.tsVueApp/src/Students/EmergencyContact/__tests__/emergency-contact-service.test.tsVueApp/src/Students/EmergencyContact/__tests__/use-emergency-contact.test.tsVueApp/src/Students/__tests__/photo-gallery-ross-checkbox.test.tsVueApp/src/Students/__tests__/photo-gallery-store.test.tsVueApp/src/Students/__tests__/use-photo-gallery-groups.test.tsVueApp/src/Students/__tests__/use-photo-gallery-options.test.tsVueApp/src/components/__tests__/rich-text-editor.test.tsVueApp/src/composables/QuasarTableUtilities.tsVueApp/src/composables/RequireLogin.tsVueApp/src/composables/ViperFetch.tsVueApp/src/composables/use-route-focus.tspackage.json
💤 Files with no reviewable changes (8)
- VueApp/src/Students/tests/photo-gallery-ross-checkbox.test.ts
- VueApp/src/ClinicalScheduler/pages/ClinicalSchedulerHome.vue
- VueApp/src/ClinicalScheduler/types/index.ts
- VueApp/src/CTS/types/index.ts
- VueApp/src/Effort/services/harvest-service.ts
- VueApp/src/Effort/types/harvest-types.ts
- VueApp/src/ClinicalScheduler/components/ScheduleView.vue
- VueApp/src/ClinicalScheduler/types/api-responses.ts
There was a problem hiding this comment.
Pull request overview
This PR expands a Dependabot dev-dependency bump into a broader “developer workflow health” update: it fixes local-install breakage from peer dependency drift, enables curated type-aware oxlint checks, addresses two functional bugs (bulk delete confirmation + week sorting), and pays down accumulated lint/test debt across the VueApp.
Changes:
- Bump root devDependencies (eslint/stylelint/oxlint/oxfmt/fallow/jscpd) and resolve
oxlint↔oxlint-tsgolintpeer mismatch; lockfile updated and audit advisories remediated. - Enable curated type-aware oxlint rules and fix/annotate resulting findings (primarily “no floating promises” and test typing cleanup).
- Fix Clinical Scheduler bulk delete confirmation gating and numeric week sorting; add regression tests.
Reviewed changes
Copilot reviewed 55 out of 56 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| VueApp/src/Students/EmergencyContact/tests/use-emergency-contact.test.ts | Make describe() labels strings to satisfy lint rules. |
| VueApp/src/Students/EmergencyContact/tests/emergency-contact-service.test.ts | Type vi.fn mocks to satisfy type-aware linting. |
| VueApp/src/Students/EmergencyContact/tests/completeness-icon.test.ts | Adjust attribute typing for stricter TS/lint expectations. |
| VueApp/src/Students/tests/use-photo-gallery-options.test.ts | Make describe() labels strings to satisfy lint rules. |
| VueApp/src/Students/tests/use-photo-gallery-groups.test.ts | Make describe() labels strings to satisfy lint rules. |
| VueApp/src/Students/tests/photo-gallery-store.test.ts | Update mocks + sync test to match non-async action shape. |
| VueApp/src/Students/tests/photo-gallery-ross-checkbox.test.ts | Remove vacuous early-return assertion so real check runs. |
| VueApp/src/Effort/types/harvest-types.ts | Remove unused local DTO type declarations. |
| VueApp/src/Effort/services/harvest-service.ts | Remove unused local progress-event type. |
| VueApp/src/Effort/composables/use-report-url-params.ts | Mark navigation promise intentionally un-awaited (void). |
| VueApp/src/Effort/tests/use-report-url-params.test.ts | Type vi.fn mocks for stricter linting. |
| VueApp/src/Effort/tests/report-service.test.ts | Type ViperFetch mocks for stricter linting. |
| VueApp/src/Effort/tests/instructor-service.test.ts | Type ViperFetch mocks for stricter linting. |
| VueApp/src/Effort/tests/instructor-edit-dialog.test.ts | Type service mocks for stricter linting. |
| VueApp/src/Effort/tests/instructor-add-dialog.test.ts | Type service mocks for stricter linting. |
| VueApp/src/Effort/tests/harvest-dialog.test.ts | Type service mocks for stricter linting. |
| VueApp/src/Effort/tests/effort-records-table.test.ts | Convert helper functions to const arrows (lint alignment). |
| VueApp/src/Effort/tests/dashboard-service.test.ts | Type ViperFetch mocks for stricter linting. |
| VueApp/src/Effort/tests/course-service.test.ts | Type ViperFetch mocks for stricter linting. |
| VueApp/src/Effort/tests/course-link-dialog.test.ts | Type service mocks for stricter linting. |
| VueApp/src/Effort/tests/course-import-dialog.test.ts | Type service mocks for stricter linting. |
| VueApp/src/Effort/tests/course-edit-dialog.test.ts | Type service mocks for stricter linting. |
| VueApp/src/Effort/tests/course-add-dialog.test.ts | Type service mocks for stricter linting. |
| VueApp/src/CTS/types/index.ts | Remove unused exported CTS types. |
| VueApp/src/CTS/tests/assessment-bubble.test.ts | Make describe() labels strings to satisfy lint rules. |
| VueApp/src/composables/ViperFetch.ts | Tighten catch typing + normalize non-Validation/Auth errors to string. |
| VueApp/src/composables/use-route-focus.ts | Mark nextTick promise intentionally un-awaited (void). |
| VueApp/src/composables/RequireLogin.ts | Use typed inject<string> and mark navigation promise un-awaited (void). |
| VueApp/src/composables/QuasarTableUtilities.ts | Simplify nullable type for formatter callback parameter. |
| VueApp/src/components/tests/rich-text-editor.test.ts | Add targeted oxlint suppression for dynamic delete in restore logic. |
| VueApp/src/CMS/composables/use-url-filtered-table.ts | Mark reload promise intentionally un-awaited (void). |
| VueApp/src/CMS/tests/use-url-filtered-table.test.ts | Update tests to match voided reload calls. |
| VueApp/src/ClinicalScheduler/types/index.ts | Remove unused Clinical Scheduler types from barrel. |
| VueApp/src/ClinicalScheduler/types/api.ts | Inline ApiError type and export it from the shared API types file. |
| VueApp/src/ClinicalScheduler/types/api-responses.ts | Delete now-redundant API response type file (ApiError moved). |
| VueApp/src/ClinicalScheduler/services/error-transformer.ts | Update ApiError import to new location. |
| VueApp/src/ClinicalScheduler/pages/ClinicalSchedulerHome.vue | Remove unused CSS class. |
| VueApp/src/ClinicalScheduler/composables/use-permission-checks.ts | Mark navigation promises intentionally un-awaited (void). |
| VueApp/src/ClinicalScheduler/composables/use-optimistic-schedule-updates.ts | Mark async queue processor intentionally un-awaited (void). |
| VueApp/src/ClinicalScheduler/composables/use-bulk-deletion.ts | Fix confirmation gating + numeric week sorting in warning message. |
| VueApp/src/ClinicalScheduler/components/ScheduleView.vue | Remove unused CSS styles. |
| VueApp/src/ClinicalScheduler/tests/use-optimistic-schedule-updates.test.ts | Tighten mock typing; adjust structuredClone mock typing. |
| VueApp/src/ClinicalScheduler/tests/use-bulk-deletion.test.ts | Add regression coverage for confirmation gating + numeric sort. |
| VueApp/src/ClinicalScheduler/tests/test-utils.ts | Tighten mock typing for localStorage + store helpers. |
| VueApp/src/ClinicalScheduler/tests/rotation-selector.test.ts | Tighten RotationService mock typing. |
| VueApp/src/ClinicalScheduler/tests/rotation-selector-api.test.ts | Tighten RotationService mock typing. |
| VueApp/src/ClinicalScheduler/tests/permissions-store-utilities.test.ts | Tighten PermissionService mock typing. |
| VueApp/src/ClinicalScheduler/tests/permissions-store-error-handling.test.ts | Tighten PermissionService mock typing. |
| VueApp/src/ClinicalScheduler/tests/permissions-store-computed.test.ts | Tighten PermissionService mock typing. |
| VueApp/src/ClinicalScheduler/tests/normalize-week.test.ts | Make describe() labels strings to satisfy lint rules. |
| VueApp/src/ClinicalScheduler/tests/normalize-schedule-semesters.test.ts | Make describe() labels strings to satisfy lint rules. |
| VueApp/src/ClinicalScheduler/tests/clinical-scheduler-home.test.ts | Tighten mock typing in error-handling tests. |
| VueApp/src/ClinicalScheduler/tests/clinical-scheduler-home-qa.test.ts | Tighten mock typing; adjust rejected-navigation mock typing. |
| package.json | Dev dependency bumps; align oxlint-tsgolint with new peer requirements. |
| package-lock.json | Lockfile updates + advisory remediations reflected in resolved tree. |
| .oxlintrc.json | Enable curated type-aware rules and explicitly disable undesired TS style rules. |
- a programmatic close fires neither onOk nor onCancel, leaving the await pending forever and wedging the bulk-delete flow - same omission in the parallel showConfirmationDialog helper
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Started as the Dependabot npm-root group bump. The batch did not install as proposed, and reviewing it surfaced two real bugs plus a pile of pre-existing lint debt, so this PR now carries that work as well.
The bump itself needed a fix
oxlint@1.75.0raised its peer requirement tooxlint-tsgolint >= 7.0.2001, but Dependabot only bumpedoxlint-tsgolintto^0.25.0, because that package switched versioning schemes (0.25.0->7.0.2000->7.0.2001, now tracking the TypeScript release it embeds).Result:
npm installfailed withERESOLVE.npm cisucceeded, so CI stayed green and hid it. The breakage only hit developers installing locally. Fixed by takingoxlint-tsgolintto^7.0.2001, which is the version released alongsideoxlint@1.75.0.Worth noting for future grouped updates: Dependabot does not cross-check peer ranges between packages in a group.
Two bugs found and fixed
The bulk delete confirmation dialog did not gate the delete.
$q.dialog()returns aDialogChainObject, not a Promise, soawaiting it resolved immediately without waiting for the user. Thecatchblock handling Cancel was unreachable and the deletion ran regardless of which button was clicked. Now gated on theonOk/onCancelcallbacks.The primary evaluator warning listed weeks out of order. The default
toSorted()is lexicographic, so week numbers rendered as1, 10, 2. Now sorts numerically.Both have regression tests that were verified to fail against the unfixed code.
Security
Patched two pre-existing HIGH advisories that this branch neither introduced nor originally fixed:
brace-expansion5.0.7 -> 5.0.9 (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895), reached via eslint -> minimatchfast-uri3.1.4 -> 3.1.5 (GHSA-7p8r-x3mc-p8w7), reached via stylelint -> table -> ajvnpm auditnow reports 0 vulnerabilities.Reviewer note: both fixed versions were younger than the
.npmrcmin-release-age=7gate, so this used a one-off--min-release-age=0. To compensate for skipping the bake period, both packages were checked directly first: maintainers, repositories and licences all unchanged against the versions they replace, no new dependencies, no install hooks..npmrcis untouched, so the gate still applies to everything else.Type-aware linting
Enabled, but curated. Turning it on wholesale produced 2,333 findings; the curated set is 21, all of which are fixed here.
Rules kept are the ones that catch real defects (
no-floating-promises,await-thenable,no-misused-promises,require-array-sort-compare). The week-ordering bug above was found byrequire-array-sort-compare.Rules switched off, with reasons in the config:
prefer-readonly-parameter-typesis unsatisfiable here, since it flags vue-router callback signatures we do not ownstrict-boolean-expressionscontradicts documented vue-router idioms and cannot see template expressions, so it would force verbose checks in script whilev-iftruthiness stays unlintedno-unnecessary-type-assertionhas an open upstream false-positive regressionAlso note the
typescriptplugin brings roughly 1,550 syntactic findings unrelated to type-aware analysis (explicit-function-return-type,no-non-null-assertionand similar). The repo never opted into those style positions, so they are disabled explicitly rather than reformatting the app.no-voidis now off for VueApp becauseno-floating-promisesprescribesvoidas its fix; the two rules are mutually exclusive. It was already off forscripts/**.Lint debt cleared
VueApp went from 27 lint errors to 0. These predate the rules that flag them:
require-mock-type-parametersacross 23 test suitesdescribe()calls passing an identifier instead of a stringconstarrowsexpect(true).toBeTruthy()and never reached its real assertionapi-responses.tswas deleted along the way: once its unused DTOs were gone it held onlyApiError, whichTypedApiResultalready depended on, so it was folded intoapi.ts.Verification
vue-tsc: cleannpm audit: 0 vulnerabilities#main-contentreceives focus), and no console errorsNot addressed
VueApp/package.jsonstill declares its owneslint@^10.5.0,oxfmt@^0.56.0andoxlint-tsgolint@^0.23.0. This PR is root-scoped, so root and VueApp now run different linter versions.VueApp/srcwithThe command line is too longon Windows. Pre-existing, unrelated to this bump, but it means stylelint is not currently linting that tree.Original Dependabot report
Bumps the npm-root group with 8 updates:
3.4.153.5.010.5.010.8.02.102.03.6.05.0.105.0.120.56.00.60.01.71.01.75.00.23.00.25.017.13.017.14.1Updates
@double-great/stylelint-a11yfrom 3.4.15 to 3.5.0Release notes
Sourced from @double-great/stylelint-a11y's releases.
Commits
8ae69a23.5.0908868aTarget Node 20/22/24 in CI; raise engines to >=22 (#138)16ca840Update NPM dependencies (#137)Updates
eslintfrom 10.5.0 to 10.8.0Release notes
Sourced from eslint's releases.
... (truncated)
Commits
749dfed10.8.04bd0d75Build: changelog update for 10.8.04fbf46dtest: pinwebpackversion to 5.108.4 (#21137)6ddf858docs: fix broken Specify Parser Options anchor link (#21106)784dfbedocs: Clarifyno-eq-nulldescription (#21120)6b8d2f7fix: escape reserved characters in rule id inhtmlformatter (#21129)2d063e2chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)eccbe7btest: add error locations tono-class-assign(#21123)2fee9bbfeat: exportConfigObjectfromeslint/config(#21082)e7d1e43ci: bump actions/setup-go from 6 to 7 (#21118)Updates
fallowfrom 2.102.0 to 3.6.0Release notes
Sourced from fallow's releases.
... (truncated)
Changelog
Sourced from fallow's changelog.
... (truncated)
Commits
32b3f89chore: release v3.6.05795c10fix(ci): drop flaky pnpm cache from release-validation setup-node4e46717fix(audit): silence Windows unnecessary_wraps on ownership no-op2fb4b7dtest(audit): resolve integration cache paths via production hash502e793test(audit): mirror production hashing in reusable-cache identity testbef4d7dchore(docker): pin FALLOW_VERSION 3.5.1 with refreshed checksums852cc98chore: remove superpowers workflow artifactsa6c74e7fix: harden analysis and integration contractsd261eb3fix(lsp): normalize Windows diagnostic paths3ab6c16fix(cli): honor JSON style for schema commandsUpdates
jscpdfrom 5.0.10 to 5.0.12Release notes
Sourced from jscpd's releases.
Changelog
Sourced from jscpd's changelog.
Commits
64258a9release: cpd-v5.0.12ff1ae36fix(rust): rename cpd binary and npm platform packages to jscpdf768035docs(readme): fix jscpd@5 bin claim and refresh npm README115f7fbrelease: cpd-v5.0.11Updates
oxfmtfrom 0.56.0 to 0.60.0Commits
83abe3brelease(apps): oxlint v1.75.0 && oxfmt v0.60.0 (#24713)e2e0f94chore(docs): update sponsor section (#24588)2d4e8d2release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)415fe1efix(oxfmt): error on ignorePatterns that cannot match files outside the confi...39677barelease(apps): oxlint v1.73.0 && oxfmt v0.58.0 (#24219)5306f24release(apps): oxlint v1.72.0 && oxfmt v0.57.0 (#23935)Updates
oxlintfrom 1.71.0 to 1.75.0Release notes
Sourced from oxlint's releases.
... (truncated)
Changelog
Sourced from oxlint's changelog.
... (truncated)
Commits
83abe3brelease(apps): oxlint v1.75.0 && oxfmt v0.60.0 (#24713)6ce51d3chore(deps): update dependency oxlint-tsgolint to v7.0.2000 (#24763)dd18383feat(linter/node): implement no-top-level-await rule (#24634)8694167fix(linter/eslint/prefer-destructuring): handle typed declarations (#24616)e2e0f94chore(docs): update sponsor section (#24588)16a65f2feat(linter/react): implement function-component-definition rule (#24471)7f1f585feat(linter): reusejest/padding-around-test-blocksfor `vitest/padding-aro...99978a8feat(linter/import/consistent-type-specifier-style): support `prefer-top-leve...2d4e8d2release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)7f80cacperf(linter/vue/prop-name-casing): precompileignorePropsregex pattern (#2...Updates
oxlint-tsgolintfrom 0.23.0 to 0.25.0Release notes
Sourced from oxlint-tsgolint's releases.
... (truncated)
Commits
1abf9a5docs: update sponsor section6ee7c11fix(no-unnecessary-type-assertion): preserve generic write casts (#1089)e23cc83fix(no-unnecessary-type-assertions): generic array false positive (#1045)c3269c0fix(no-unnecessary-type-assertion): avoid recursive unknown checks (#1086)c214d5cchore: update Node.js to 26.5.0 (#1087)002b818refactor: drop dead isFunction guards built on a bitwise ast.Kind mask (#1078)d6a1cb2refactor: remove dead code from rules (#1079)7823d59refactor: miscellaneous code cleanup (#1077)fcf43ffperf(no-unnecessary-type-arguments): skip signature resolution when node has ...6875914chore(deps): update gomod (#1081)Updates
stylelintfrom 17.13.0 to 17.14.1Release notes
Sourced from stylelint's releases.