Skip to content

chore(deps): bump eslint-plugin-simple-import-sort from 12.1.1 to 14.0.0 - #262

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/eslint-plugin-simple-import-sort-14.0.0
Closed

chore(deps): bump eslint-plugin-simple-import-sort from 12.1.1 to 14.0.0#262
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/eslint-plugin-simple-import-sort-14.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps eslint-plugin-simple-import-sort from 12.1.1 to 14.0.0.

Changelog

Sourced from eslint-plugin-simple-import-sort's changelog.

Version 14.0.0 (2026-07-16)

ES2022 allows string literals as module export names ("arbitrary module namespace names"):

export { yukuTs as "yuku-ts" };
import { "a-b" as c } from "a";

This release adds support for such quotes names. Previously, those were sorted oddly, and the autofix could suggest changes that wasn’t valid syntax.

This is only a breaking change if you use string literals as module export names, and only in the form of that you need to autofix your files.

Thanks to Kamronbek_Juraev (@​KAMRONBEK) for fixing this!

Version 13.0.0 (2026-04-06)

This release puts imports from the same source, but with different import styles, in a deterministic order.

// First namespace imports:
import * as Circle from "circle;
// Then default imports:
import createCircle from "circle";
// Then named imports:
import { radius } from "circle";

That is especially useful if you need to have both a namespace import and want to import a few things separately (since that cannot be combined into a single import statement). With the above rule, the imports end up in a deterministic order.

It’s only a breaking change if you import from the same source multiple times in the same file (using different styles), and only in the form that you need to autofix your files.

Thanks to Kannan Goundan (@​cakoose)!

Commits
  • bef18bd eslint-plugin-simple-import-sort v14.0.0
  • d53d160 Fix autofix and sort order for quoted names (#217)
  • 6063737 Bump js-yaml from 4.1.1 to 4.3.0 (#214)
  • 143b70e Bump vitest and @​vitest/coverage-v8 (#212)
  • 0f59276 Bump vite from 7.1.11 to 7.3.2 (#211)
  • 24d74cd Bump lodash from 4.17.23 to 4.18.1 (#210)
  • 8974606 Update GitHub Actions (#209)
  • 90078e7 eslint-plugin-simple-import-sort v13.0.0
  • 7794d14 Determinstic ordering between different import styles (#203)
  • 5ce648a Fix deprecation warning when running tests
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
@dependabot
dependabot Bot requested a review from AKogut as a code owner August 10, 2026 17:21
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
AKogut added a commit that referenced this pull request Aug 18, 2026
…266)

`pnpm audit --prod --audit-level high` currently fails on `main`.

That is worth stating plainly first, because it also explains something
that looked like noise: the audit check is red on almost every open
dependabot pull request, **including #258, which bumps
`pnpm/action-setup`** — a GitHub Action that cannot affect a dependency
tree at all. The branches were not broken. The base was.

## The three

| Package | Found | Fixed in | Arrives through |
| --- | --- | --- | --- |
| `js-yaml` | 3.15.0 | ≥3.15.1 | `@istanbuljs/load-nyc-config`, via
jest's coverage chain |
| `nanoid` | 3.3.16 | ≥3.3.18 | `postcss` — whose existing override had
drifted behind its own advisory |
| `deepmerge-ts` | 7.1.5 | ≥8.0.0 | `@prisma/config`, and Prisma 7 is
the only release carrying the fixed one |

None is reachable by a direct bump, which is what the comment in
`audit.yml` already anticipated: *"advisories reachable through a
transitive pin that only a resolution override can clear."*

## Why the overrides are scoped

`js-yaml` also ships a 4.x line. A bare `"js-yaml": "^3.15.1"` override
would drag every 4.x consumer backwards to fix a 3.x problem — so it is
pinned under the one parent that pulls the vulnerable copy. Same
reasoning for `deepmerge-ts`: version 8 is wanted under Prisma, not
everywhere.

`postcss` was already overridden; that entry had simply fallen behind.
Raising it also cleared `nanoid`, since that is where it came from.

## The part I did not assume

Forcing a **major** of `deepmerge-ts` underneath Prisma 6 is exactly the
kind of change that type-checks and then falls over at runtime, so it
was run rather than reasoned about: the full suite against a live
Postgres, every database-backed test included.

```
Tasks: 28 successful, 28 total
```

Plus build, typecheck and lint: 47/47.

## Result

Five findings become one:

```
before  1 low | 1 moderate | 3 high
after   1 low
```

The remainder is an esbuild development-server file-read on Windows —
below the `--audit-level high` gate the workflow enforces, and reported
by the second, non-failing audit step that already exists for exactly
this.

## What this unblocks

#261 (zod 4) and #263 (prisma 7) fail on their own merits and still need
work. The rest — #258, #262, #264, #265 — were failing only on this, and
should go green on a rebase.
@AKogut

AKogut commented Aug 18, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

Bumps [eslint-plugin-simple-import-sort](https://github.com/lydell/eslint-plugin-simple-import-sort) from 12.1.1 to 14.0.0.
- [Changelog](https://github.com/lydell/eslint-plugin-simple-import-sort/blob/main/CHANGELOG.md)
- [Commits](lydell/eslint-plugin-simple-import-sort@v12.1.1...v14.0.0)

---
updated-dependencies:
- dependency-name: eslint-plugin-simple-import-sort
  dependency-version: 14.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/eslint-plugin-simple-import-sort-14.0.0 branch from 78da7d8 to 4e5474c Compare August 18, 2026 08:15
@AKogut

AKogut commented Aug 18, 2026

Copy link
Copy Markdown
Owner

Superseded by #272. This went conflicted when #266 touched the lockfile and dependabot did not pick it back up, so its checks kept failing on an advisory main no longer has. Same 12.1.1 → 14.0.0 bump, applied on the fixed base and verified — two majors of an import-order rule is worth confirming the whole repo still lints, and it does.

@AKogut AKogut closed this Aug 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/eslint-plugin-simple-import-sort-14.0.0 branch August 18, 2026 08:16
AKogut added a commit that referenced this pull request Aug 18, 2026
Replaces #262 and #264.

Both went `DIRTY` when #266 touched `package.json` and the lockfile, and
dependabot did not pick them back up after being asked. Their checks
kept running against the old base, so they kept failing on the advisory
`main` no longer has — which would have looked like the bumps' fault
indefinitely.

Same versions, applied on the fixed base:

| | from | to |
| --- | --- | --- |
| `eslint-plugin-simple-import-sort` | 12.1.1 | 14.0.0 |
| `tsx` | 4.19.2 | 4.23.12 |
| `eslint` | 10.8.0 | 10.8.1 |
| `turbo` | 2.10.8 | 2.10.10 |

`simple-import-sort` crossing **two majors** is the one that deserved
checking rather than a shrug — it decides whether every import block in
the repo still lints, and lint is a required check. It does, unchanged.

```
Tasks: 62 successful, 62 total
```

Build, typecheck, lint and the full test suite against a live Postgres.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant