feat(base): ban bare @conform-to/zod import specifier - #38
Merged
Conversation
The bare `@conform-to/zod` specifier targets Zod v3 and throws at RUNTIME, uncaught by typecheck, lint, and build, so a wrong import ships silently and only fails in the running app. Add a global `no-restricted-imports` `paths` ban (exact-match, so the distinct `@conform-to/zod/v4` specifier stays allowed) via a shared `RESTRICTED_IMPORT_PATHS` const. The same const is spread into testing.ts's existing `no-restricted-imports` block so test/story files keep the conform ban alongside their server-only/`internals` restrictions (flat config replaces a rule's options wholesale, so the later block would otherwise drop it). Reconcile the lagging source with published reality: bump to 1.9.0, drop the already-shipped `no-zod-enum` changeset, and backfill its 1.9.0 CHANGELOG entry so the next release bumps to 1.10.0 instead of colliding with published 1.9.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012zBEFqBaJAUkq8Mdhdk5Xo
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Ban the bare
@conform-to/zodimport specifier viano-restricted-importsin the shared base config.The bare
@conform-to/zodspecifier targets Zod v3 and throws at runtime — uncaught by typecheck, lint, and build — so a wrong import ships silently and only fails in the running app. This adds a lint-time guardrail so every consuming app catches it.How
RESTRICTED_IMPORT_PATHS(src/configs/restricted-imports.ts), using exact-matchpaths(notpatterns), so the distinct@conform-to/zod/v4specifier stays allowed.no-restricted-importsblock added tobase.ts, scoped to**/*.ts?(x).testing.ts's existingno-restricted-importsblock (which bans*.server/internalson test/story files). Flat config replaces a rule's options wholesale, so without this the conform ban would be dropped on test/story files. Both call sites reference the one const to stay DRY.src/configs/restricted-imports.test.tslints real snippets against the actual exported config blocks (extracted by name frombuildBase()andtesting): proves a bare import errors, a/v4import does not, and — regression — that*.server/internalsbans still fire on test files.Version reconciliation
Source lagged published reality:
package.jsonwas1.8.0while npm latest was1.9.0(theno-zod-enumrule shipped as1.9.0but the version bump/changeset-consumption was never committed, and there is nov1.9.0tag). Left as-is, the nextchangeset versionwould bump1.8.0 → 1.9.0and collide with the published1.9.0. This PR:package.jsonto1.9.0.no-zod-enumchangeset.## 1.9.0CHANGELOG entry (PR feat: add no-zod-enum guardrail #36 /fe262a6).So the changesets action will now correctly bump to
1.10.0.Bump level
Minor. A new error-level rule can break a consumer that violates it, but the package's convention ships new guardrail rules as minor (
no-zod-enum,no-null-renderboth did), and the sole known consumer (gaia) is clean — all usages are already@conform-to/zod/v4.Verification
pnpm typecheck && pnpm lint && pnpm test && pnpm buildall green. 22 tests pass (6 new).🤖 Generated with Claude Code
https://claude.ai/code/session_012zBEFqBaJAUkq8Mdhdk5Xo