Skip to content

Clear ESLint toolchain audit findings - #95

Merged
luinbytes merged 2 commits into
masterfrom
fix/eslint-audit
Nov 12, 2026
Merged

luinbytes merged 2 commits into
masterfrom
fix/eslint-audit

Conversation

@openbotgit

@openbotgit openbotgit Bot commented Nov 12, 2026 •

Copy link
Copy Markdown
Contributor

Description

Clear the seven moderate development dependency findings in the ESLint toolchain. Update typescript-eslint to stable 8.72.2 and scope a minimatch@11.0.1 override to @typescript-eslint/typescript-estree, then regenerate the npm lockfile.

The audit's suggested typescript-eslint@8.36.0 downgrade still reports all seven findings when tested. Latest stable 8.72.2 still requests vulnerable minimatch 10.x, so the narrow override selects the first version outside the advisory range. Remove the override when upstream adopts a patched compatible dependency.

The dependency update changes only package.json and package-lock.json. No lint rule or runtime dependency changes were needed. Production audit remains zero. No changes to #94.

The first CI run hit the existing heading-click race. Following the requested follow-up, a separate two-line browser test change waits for the project grid entrance transform to finish and recenters the heading before the real click. Frame sampling confirmed that an instant scroll alone still left 22px of grid motion. The click and pointer-isolation assertion remain, with no forced click or disabled animation. Product code is unchanged.

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation update

Testing

Head: ca301b4d9ac000fda7429145a65c167ccc5cf188.

Before npm audit: 7 moderate, 7 total
After npm audit:  0 vulnerabilities
npm audit --omit=dev: 0 vulnerabilities
  • Local npm run lint and production build pass.
  • Focused desktop/mobile browser test passes after the synchronization fix.
  • npm ls confirms the overridden minimatch version with a valid dependency tree.
  • git diff --check passes; every changed non-root lock entry is development only.
  • Linux Node 22 CI run 43275815287: audit, lint, 54 pond tests and all 49 production browser tests, including the build, pass at this exact head.

No merge or deployment. Full local browser tests were not repeated; the exact final head will be verified in Linux CI.

Screenshots (if applicable)

No UI changes.

@luinbytes
luinbytes merged commit 69edc62 into master Nov 12, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant