Update `minimatch`

[benmccann]

Which packages would you like to change?

• @eslint/compat
• @eslint/config-array
• @eslint/migrate-config
• @eslint/object-schema

What problem do you want to solve?

Upgrading to a newer version would reduce the number of dependencies and allow the remaining dependencies to dedupe better

rewrite/packages/config-array/package.json

Line 51 in 8501890

"minimatch": "^3.1.2"

What do you think is the correct solution?

version 9 is now available. if it's a difficult upgrade perhaps upgrading to an intermediate version would be an easier step

Participation

• I am willing to submit a pull request for this change.

Additional comments

No response

[mdjermanovic]

We're using minimatch v3 in ESLint too, for both flat and eslintrc config functionalities. We're also using minimatch v3 in @eslint/eslintrc, which is still a dependency of ESLint. So if we upgrade only here, there will still be minimatch v3 in the dependency tree, which is probably not what we want. Since we'd prefer not to make any changes in eslintrc code at this point, I think it would be better to postpone this upgrade for ESLint v10, when we'll remove everything related to eslintrc.

@eslint/eslint-tsc thoughts?

[nzakas]

IIRC, the reason we haven't upgraded is because it looked like there were some changes in functionality that caused our tests to break. I don't see any compelling reason to upgrade right now.

We can definitely think about this for v10, though we should keep in mind that this package will be depended by v9 as well, which should affect how we manage semver around this.

[bluwy]

One reason to upgrade is to cleanup the dependency graph a little. For minimatch@3:

ESLint is currently the main factor concat-map v0.0.1 (unnecessary package and no longer depended by minimatch) still has 46M downloads/week.

Understandably it's hard to ensure all eslint packages update at the same time and without breaking changes, but I hope we can slowly trim down transitive packages and code as eslint adapts to newer node versions.

[nzakas]

@bluwy we aren't looking for reasons to upgrade. As already mentioned, when we tried upgrading before it broke some behavior so that's the key consideration here.