You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@kyuubi.apache.org by "wangzhigang1999 (via GitHub)" <gi...@apache.org> on 2026/07/02 02:04:06 UTC
[PR] [KYUUBI][WEBUI] Upgrade ESLint to 9 (flat config) and clear remaining dev-dependency advisories [kyuubi]
wangzhigang1999 opened a new pull request, #7538:
URL: https://github.com/apache/kyuubi/pull/7538
### Why are the changes needed?
Follow-up to #7533. That change modernized the web-ui toolchain but deferred the lint stack. ESLint 8 is end-of-life and its transitive dependencies still carry dev-only advisories. This upgrades the lint stack to ESLint 9 (flat config) and takes `pnpm audit` (dev + prod) to zero.
- `eslint` 8->9.39, `@typescript-eslint/{eslint-plugin,parser}` 5 -> unified `typescript-eslint` 8, `eslint-plugin-vue` 9->10, `@vue/eslint-config-typescript` 11->14, `eslint-plugin-prettier` 4->5, `prettier` 2->3, add `@eslint/js`, drop `@vue/eslint-config-prettier`.
- Convert `.eslintrc` to flat config `eslint.config.js` (ESLint 9 drops eslintrc support).
- Pin `brace-expansion@1` and `picomatch@2` via version-scoped `pnpm.overrides` to clear the last transitive advisories from the ESLint 9 chain.
- Prettier 3 formatting (6 files, cosmetic only).
`pnpm audit`: 12 vulnerabilities (6 high / 5 moderate / 1 low) -> 0.
The rule set is preserved across the format change; removed rules are mapped to successors:
| `.eslintrc` (ESLint 8) | `eslint.config.js` (ESLint 9) |
| --- | --- |
| `plugin:vue/vue3-recommended` | `pluginVue.configs['flat/recommended']` |
| `eslint:recommended` | `js.configs.recommended` |
| `@vue/typescript/recommended` | `vueTsConfigs.recommended` |
| `@vue/prettier` (prettier as a rule) | `eslint-plugin-prettier/recommended` |
| `@typescript-eslint/ban-types: off` | `no-empty-object-type` / `no-unsafe-function-type` / `no-wrapper-object-types: off` |
| `@typescript-eslint/no-empty-interface: off` | `no-empty-object-type: off` |
| `vue/no-setup-props-destructure: off` | `vue/no-setup-props-reactivity-loss: off` |
| `quotes` / `comma-dangle` / `space-before-function-paren` | owned by Prettier (`.prettierrc`) |
### How was this patch tested?
On Node 22 / pnpm 9.11 (matching CI): `pnpm install --frozen-lockfile`, `pnpm run lint` (0 problems), `pnpm run build`, `pnpm run coverage` (80 tests), and `pnpm audit` = 0.
### Was this patch authored or co-authored using generative AI tooling?
Assisted-by: Claude Opus 4.8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [KYUUBI][WEBUI] Upgrade ESLint to 9 (flat config) and clear remaining dev-dependency advisories [kyuubi]
Posted by "wangzhigang1999 (via GitHub)" <gi...@apache.org>.
wangzhigang1999 commented on PR #7538:
URL: https://github.com/apache/kyuubi/pull/7538#issuecomment-4861660274
This is the ESLint 9 follow-up referenced in #7534. Once this PR is merged, the remaining Dependabot web-ui security bumps become redundant and can be closed — each package is now at/above the patched version via the ESLint 9 upgrade:
- #7364 flatted — now 3.4.2
- #7340 ajv — now 6.15.0 (≥ 6.14.0)
- #7338 minimatch — now 3.1.5
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [KYUUBI][WEBUI] Upgrade ESLint to 9 (flat config) and clear remaining dev-dependency advisories [kyuubi]
Posted by "wangzhigang1999 (via GitHub)" <gi...@apache.org>.
wangzhigang1999 commented on PR #7538:
URL: https://github.com/apache/kyuubi/pull/7538#issuecomment-4862984821
Thanks，merged into master.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [KYUUBI][WEBUI] Upgrade ESLint to 9 (flat config) and clear remaining dev-dependency advisories [kyuubi]
Posted by "wangzhigang1999 (via GitHub)" <gi...@apache.org>.
wangzhigang1999 closed pull request #7538: [KYUUBI][WEBUI] Upgrade ESLint to 9 (flat config) and clear remaining dev-dependency advisories
URL: https://github.com/apache/kyuubi/pull/7538
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org