Addresses #10 / Update `semver` to the latest to fix CVE / Remove unnecessary dependencies #11

SukkaW · 2023-07-02T11:15:26Z

The PR does the following things:

Set the target to Node.js 12+
- Removes all unnecessary polyfills, close Drop all those unnecessary polyfills #10
Replace is-core-module with require('module').Module.builtinModules, replace has with Object.prototype.hasOwnProperty.call
- Why fewer dependencies is better: Addresses #10 / Update semver to the latest to fix CVE / Remove unnecessary dependencies #11 (comment)
Update semver to the latest version
- This fixes the following issue:
- This also addresses the following PRs:
  - [Deps] update semver import-js/eslint-plugin-import#2810
  - Update package.json import-js/eslint-plugin-import#2812

eslint-plugin-i is a fork of eslint-plugin-import that replaces the tsconfig-paths with the faster and more lightweight get-tsconfig, which also addresses the following issues:

If you want to replace eslint-plugin-import with eslint-plugin-i, just run following command in your projects:

# npm
npm install -D eslint-plugin-import@npm:eslint-plugin-i@latest
# yarn
yarn add -D eslint-plugin-import@npm:eslint-plugin-i@latest
# pnpm
pnpm add -D eslint-plugin-import@npm:eslint-plugin-i@latest

changeset-bot · 2023-07-02T11:15:29Z

⚠️ No Changeset found

Latest commit: efb9326

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

NWYLZW

Good job!

codecov · 2023-07-02T12:25:36Z

Codecov Report

Patch coverage: 100.00% and project coverage change: -0.26 ⚠️

Comparison is base (616ac75) 95.02% compared to head (efb9326) 94.76%.

Additional details and impacted files

@@               Coverage Diff                @@
##           fork-release      #11      +/-   ##
================================================
- Coverage         95.02%   94.76%   -0.26%     
================================================
  Files                68       68              
  Lines              2977     2982       +5     
  Branches           1028     1028              
================================================
- Hits               2829     2826       -3     
- Misses              148      156       +8

Impacted Files	Coverage Δ
src/ExportMap.js	`89.47% <ø> (ø)`
src/core/importType.js	`100.00% <ø> (ø)`
src/rules/no-unused-modules.js	`96.00% <ø> (-1.65%)`	⬇️
resolvers/webpack/index.js	`62.62% <100.00%> (ø)`
src/rules/export.js	`100.00% <100.00%> (ø)`
src/rules/group-exports.js	`100.00% <100.00%> (ø)`
src/rules/no-anonymous-default-export.js	`100.00% <100.00%> (ø)`
src/rules/order.js	`99.18% <100.00%> (+<0.01%)`	⬆️

... and 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

SukkaW · 2023-07-02T12:26:26Z

Ops, it seems that I forgot to remove those outdated Node.js versions from the CI matrix!

JounQin · 2023-07-02T12:26:48Z

What benefits would we get from this do you think?

SukkaW · 2023-07-02T12:30:02Z

What benefits would we get from this do you think?

Less disk occupation due to smaller node_modules and smaller ~/.npm
Faster npm i / yarn / pnpm i due to fewer packages needing to be installed
Faster eslint . since polyfills are (and always will be) slower than native methods
Less dependencies may reduce possible supply-chain attacks, pointed out by @g-plane

so1ve · 2023-07-02T12:41:24Z

Can we drop is-core-module as well?

UPD:

Maybe we can't :(

SukkaW · 2023-07-02T12:44:50Z

Can we drop is-core-module as well?

UPD:

Maybe we can't :(

@so1ve Actually maybe we can! The module.builtinModules is definitely available in Node.js 12.0.0+!

https://nodejs.org/dist/latest-v18.x/docs/api/module.html#modulebuiltinmodules

JounQin · 2023-07-02T12:48:17Z

I'm not so sure for these, actually I was thinking to maintain this package separately from the upstream.

As you said, such changes make rebasing a bit complicated, if we do so it would mean we're really start "forking", but it would mean a lot of extra efforts and hurt the community I think.

But of course, I would like to listen from the community, I was trying to support the same node versions as upstream but it's also boring and "ridiculous". So I like such changes personally, but also I'm in awe of this impactful project.

Let's wait for some more feedback for a while.

nonzzz

LGTM

g-plane · 2023-07-02T13:49:43Z

Additionally, less dependencies may reduce possible supply-chain attacks.

pionxzh

I support the idea of reducing unnecessary dependencies.

bakkot · 2023-07-02T21:56:49Z

You can replace has with {}.hasOwnProperty.call, also.

SukkaW · 2023-07-03T03:00:43Z

@JounQin

Although ljharb hasn't been actively maintaining eslint-plugin-import for literally months while he is basically held that open-source project as a hostage, we should still try our best to stay close to the upstream.

I have rebased the PR and minimized the affected lines to ensure that there will be least merging conflicts in the future.

Update

I also move is-core-module to devDeps (even less dependency to be installed!). I still retain the is-core-module in the tests, to make sure the behavior doesn't change.

SukkaW · 2023-07-03T15:49:00Z

I have bumped the semver to the latest version in the latest commit, which basically fixes all these issues and PRs:

All test cases pass on my machine, waiting for the CI.

package.json

src/rules/export.js

JounQin · 2023-07-04T07:54:52Z

Thanks, lets make it happen.

SukkaW · 2023-07-04T09:28:20Z

GitHub Action broke again.

so1ve · 2023-07-04T09:30:00Z

Let's drop node 13 15 17 19

package.json

pionxzh · 2023-07-04T10:12:36Z

We also need to update the Node.js versions in appveyor config.

https://github.com/un-es/eslint-plugin-i/blob/616ac75b11731f41a3786bdbe2c7620d65df9ded/appveyor.yml#L8-L14

so1ve · 2023-07-04T10:55:09Z

I guess we can delete that file because we don't use appveyor at all

SukkaW · 2023-07-04T14:23:32Z

We also need to update the Node.js versions in appveyor config.

https://github.com/un-es/eslint-plugin-i/blob/616ac75b11731f41a3786bdbe2c7620d65df9ded/appveyor.yml#L8-L14

I guess we can delete that file because we don't use appveyor at all

I don't know. IMHO the PR has contained enough changes. @JounQin What do you think?

JounQin · 2023-07-04T14:32:13Z

I don't know. IMHO the PR has contained enough changes. @JounQin What do you think?

It's not used, then no change is needed.

.github/workflows/node-4+.yml

Co-authored-by: JounQin <admin@1stg.me>

JounQin · 2023-12-18T03:53:17Z

For anyone may be interested, I just upgraded debug to v4 and removed unused resolve dependencies at v2.29.1. And I tried to upgrade minimatch to v9 but it fails on some cases like

import-js#2900 (comment)

and

https://github.com/import-js/eslint-plugin-import/blob/ee5fadeffff68f2300bed7f67a310496cb969d61/tests/src/rules/no-internal-modules.js

I don't have enough time to work on this replacement, anyone interested can help to raise a PR which will be appreciated.

For import-js#2900 (comment), I think it should be changed to invalid cases instead.

Tracking this replacement at #22

Targets Node.js 12

c273af3

hanayashiki approved these changes Jul 2, 2023

View reviewed changes

NWYLZW approved these changes Jul 2, 2023

View reviewed changes

g-plane approved these changes Jul 2, 2023

View reviewed changes

himself65 approved these changes Jul 2, 2023

View reviewed changes

so1ve approved these changes Jul 2, 2023

View reviewed changes

nonzzz approved these changes Jul 2, 2023

View reviewed changes

pionxzh approved these changes Jul 2, 2023

View reviewed changes

SukkaW added 5 commits July 3, 2023 10:47

Update GitHub Actions Node.js matrix

59e3ba3

Drop object.values

b44c241

Drop array-includes

50492fe

Drop array.prototype.flatmap

7d71310

Drop array.prototype.flat

300cd7f

SukkaW force-pushed the drop-polyfills branch from 248c0de to 300cd7f Compare July 3, 2023 02:59

SukkaW added 2 commits July 3, 2023 11:26

Move is-core-module to devDeps

8ca0ae5

Drop has

ae6e28f

SukkaW changed the title ~~Addresses #10~~ Addresses #10 / Update semver to the latest to fix CVE / Remove unnecessary dependencies Jul 3, 2023

laosb approved these changes Jul 3, 2023

View reviewed changes

kwaa approved these changes Jul 4, 2023

View reviewed changes

NWYLZW approved these changes Jul 4, 2023

View reviewed changes

JounQin requested changes Jul 4, 2023

View reviewed changes

package.json Outdated Show resolved Hide resolved

Bump semver to the latest version

20a0858

SukkaW requested a review from JounQin July 4, 2023 07:34

JounQin requested changes Jul 4, 2023

View reviewed changes

src/rules/export.js Show resolved Hide resolved

SukkaW requested a review from JounQin July 4, 2023 09:11

g-plane reviewed Jul 4, 2023

View reviewed changes

package.json Outdated Show resolved Hide resolved

Drop ESLint <=6 in peerDeps

963b028

JounQin requested changes Jul 4, 2023

View reviewed changes

.github/workflows/node-4+.yml Show resolved Hide resolved

Chore: reflect change history

5481192

pan93412 approved these changes Jul 4, 2023

View reviewed changes

SukkaW requested a review from JounQin July 4, 2023 14:48

ci: remove eslint 7- tests

efb9326

JounQin approved these changes Jul 4, 2023

View reviewed changes

JounQin merged commit 644d438 into un-ts:fork-release Jul 4, 2023

JounQin added a commit that referenced this pull request Jul 31, 2023

feat!: bump semver, remove unnecessary dependencies (#11)

0e7cfe3

Co-authored-by: JounQin <admin@1stg.me>

JounQin added a commit that referenced this pull request Jul 31, 2023

feat!: bump semver, remove unnecessary dependencies (#11)

7903a85

Co-authored-by: JounQin <admin@1stg.me>

JounQin mentioned this pull request Aug 15, 2023

Add missing dependencies #14

Closed

JounQin mentioned this pull request Dec 18, 2023

deps: upgrade minimatch to v9 but it fails on some cases #22

Closed

JounQin mentioned this pull request Jan 30, 2024

What is the ultimate purpose of this plug-in/fork? #27

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Addresses #10 / Update `semver` to the latest to fix CVE / Remove unnecessary dependencies #11

Addresses #10 / Update `semver` to the latest to fix CVE / Remove unnecessary dependencies #11

SukkaW commented Jul 2, 2023 •

edited by JounQin

Loading

changeset-bot bot commented Jul 2, 2023 •

edited

Loading

NWYLZW left a comment

codecov bot commented Jul 2, 2023 •

edited

Loading

SukkaW commented Jul 2, 2023

JounQin commented Jul 2, 2023

SukkaW commented Jul 2, 2023 •

edited

Loading

so1ve commented Jul 2, 2023 •

edited

Loading

SukkaW commented Jul 2, 2023 •

edited

Loading

Can we drop `is-core-module` as well?

JounQin commented Jul 2, 2023 •

edited

Loading

nonzzz left a comment

g-plane commented Jul 2, 2023

pionxzh left a comment

bakkot commented Jul 2, 2023

SukkaW commented Jul 3, 2023 •

edited

Loading

SukkaW commented Jul 3, 2023 •

edited

Loading

JounQin commented Jul 4, 2023 •

edited

Loading

SukkaW commented Jul 4, 2023

so1ve commented Jul 4, 2023

pionxzh commented Jul 4, 2023

so1ve commented Jul 4, 2023

SukkaW commented Jul 4, 2023

JounQin commented Jul 4, 2023

JounQin commented Dec 18, 2023 •

edited

Loading

Addresses #10 / Update semver to the latest to fix CVE / Remove unnecessary dependencies #11

Addresses #10 / Update semver to the latest to fix CVE / Remove unnecessary dependencies #11

Conversation

SukkaW commented Jul 2, 2023 • edited by JounQin Loading

changeset-bot bot commented Jul 2, 2023 • edited Loading

⚠️ No Changeset found

NWYLZW left a comment

Choose a reason for hiding this comment

codecov bot commented Jul 2, 2023 • edited Loading

Codecov Report

SukkaW commented Jul 2, 2023

JounQin commented Jul 2, 2023

SukkaW commented Jul 2, 2023 • edited Loading

so1ve commented Jul 2, 2023 • edited Loading

SukkaW commented Jul 2, 2023 • edited Loading

Can we drop is-core-module as well?

JounQin commented Jul 2, 2023 • edited Loading

nonzzz left a comment

Choose a reason for hiding this comment

g-plane commented Jul 2, 2023

pionxzh left a comment

Choose a reason for hiding this comment

bakkot commented Jul 2, 2023

SukkaW commented Jul 3, 2023 • edited Loading

SukkaW commented Jul 3, 2023 • edited Loading

JounQin commented Jul 4, 2023 • edited Loading

SukkaW commented Jul 4, 2023

so1ve commented Jul 4, 2023

pionxzh commented Jul 4, 2023

so1ve commented Jul 4, 2023

SukkaW commented Jul 4, 2023

JounQin commented Jul 4, 2023

JounQin commented Dec 18, 2023 • edited Loading

Addresses #10 / Update `semver` to the latest to fix CVE / Remove unnecessary dependencies #11

Addresses #10 / Update `semver` to the latest to fix CVE / Remove unnecessary dependencies #11

SukkaW commented Jul 2, 2023 •

edited by JounQin

Loading

changeset-bot bot commented Jul 2, 2023 •

edited

Loading

codecov bot commented Jul 2, 2023 •

edited

Loading

SukkaW commented Jul 2, 2023 •

edited

Loading

so1ve commented Jul 2, 2023 •

edited

Loading

SukkaW commented Jul 2, 2023 •

edited

Loading

Can we drop `is-core-module` as well?

JounQin commented Jul 2, 2023 •

edited

Loading

SukkaW commented Jul 3, 2023 •

edited

Loading

SukkaW commented Jul 3, 2023 •

edited

Loading

JounQin commented Jul 4, 2023 •

edited

Loading

JounQin commented Dec 18, 2023 •

edited

Loading