chore(deps): bump eslint-plugin-simple-import-sort from 12.1.1 to 14.0.0 - #262
Conversation
…266) `pnpm audit --prod --audit-level high` currently fails on `main`. That is worth stating plainly first, because it also explains something that looked like noise: the audit check is red on almost every open dependabot pull request, **including #258, which bumps `pnpm/action-setup`** — a GitHub Action that cannot affect a dependency tree at all. The branches were not broken. The base was. ## The three | Package | Found | Fixed in | Arrives through | | --- | --- | --- | --- | | `js-yaml` | 3.15.0 | ≥3.15.1 | `@istanbuljs/load-nyc-config`, via jest's coverage chain | | `nanoid` | 3.3.16 | ≥3.3.18 | `postcss` — whose existing override had drifted behind its own advisory | | `deepmerge-ts` | 7.1.5 | ≥8.0.0 | `@prisma/config`, and Prisma 7 is the only release carrying the fixed one | None is reachable by a direct bump, which is what the comment in `audit.yml` already anticipated: *"advisories reachable through a transitive pin that only a resolution override can clear."* ## Why the overrides are scoped `js-yaml` also ships a 4.x line. A bare `"js-yaml": "^3.15.1"` override would drag every 4.x consumer backwards to fix a 3.x problem — so it is pinned under the one parent that pulls the vulnerable copy. Same reasoning for `deepmerge-ts`: version 8 is wanted under Prisma, not everywhere. `postcss` was already overridden; that entry had simply fallen behind. Raising it also cleared `nanoid`, since that is where it came from. ## The part I did not assume Forcing a **major** of `deepmerge-ts` underneath Prisma 6 is exactly the kind of change that type-checks and then falls over at runtime, so it was run rather than reasoned about: the full suite against a live Postgres, every database-backed test included. ``` Tasks: 28 successful, 28 total ``` Plus build, typecheck and lint: 47/47. ## Result Five findings become one: ``` before 1 low | 1 moderate | 3 high after 1 low ``` The remainder is an esbuild development-server file-read on Windows — below the `--audit-level high` gate the workflow enforces, and reported by the second, non-failing audit step that already exists for exactly this. ## What this unblocks #261 (zod 4) and #263 (prisma 7) fail on their own merits and still need work. The rest — #258, #262, #264, #265 — were failing only on this, and should go green on a rebase.
|
@dependabot rebase |
Bumps [eslint-plugin-simple-import-sort](https://github.com/lydell/eslint-plugin-simple-import-sort) from 12.1.1 to 14.0.0. - [Changelog](https://github.com/lydell/eslint-plugin-simple-import-sort/blob/main/CHANGELOG.md) - [Commits](lydell/eslint-plugin-simple-import-sort@v12.1.1...v14.0.0) --- updated-dependencies: - dependency-name: eslint-plugin-simple-import-sort dependency-version: 14.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
78da7d8 to
4e5474c
Compare
|
Superseded by #272. This went conflicted when #266 touched the lockfile and dependabot did not pick it back up, so its checks kept failing on an advisory main no longer has. Same 12.1.1 → 14.0.0 bump, applied on the fixed base and verified — two majors of an import-order rule is worth confirming the whole repo still lints, and it does. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Replaces #262 and #264. Both went `DIRTY` when #266 touched `package.json` and the lockfile, and dependabot did not pick them back up after being asked. Their checks kept running against the old base, so they kept failing on the advisory `main` no longer has — which would have looked like the bumps' fault indefinitely. Same versions, applied on the fixed base: | | from | to | | --- | --- | --- | | `eslint-plugin-simple-import-sort` | 12.1.1 | 14.0.0 | | `tsx` | 4.19.2 | 4.23.12 | | `eslint` | 10.8.0 | 10.8.1 | | `turbo` | 2.10.8 | 2.10.10 | `simple-import-sort` crossing **two majors** is the one that deserved checking rather than a shrug — it decides whether every import block in the repo still lints, and lint is a required check. It does, unchanged. ``` Tasks: 62 successful, 62 total ``` Build, typecheck, lint and the full test suite against a live Postgres.
Bumps eslint-plugin-simple-import-sort from 12.1.1 to 14.0.0.
Changelog
Sourced from eslint-plugin-simple-import-sort's changelog.
Commits
bef18bdeslint-plugin-simple-import-sort v14.0.0d53d160Fix autofix and sort order for quoted names (#217)6063737Bump js-yaml from 4.1.1 to 4.3.0 (#214)143b70eBump vitest and@vitest/coverage-v8(#212)0f59276Bump vite from 7.1.11 to 7.3.2 (#211)24d74cdBump lodash from 4.17.23 to 4.18.1 (#210)8974606Update GitHub Actions (#209)90078e7eslint-plugin-simple-import-sort v13.0.07794d14Determinstic ordering between different import styles (#203)5ce648aFix deprecation warning when running tests