build(deps): bump dependencies and migrate to ESLint 10 flat config#544
Merged
Merged
Conversation
Reviewer's GuideThis PR upgrades key dependencies (Mocha, Chai, Sinon, ESLint, TypeScript, etc.), migrates ESLint to the new v10 flat config with import-x and built-in formatting rules, and updates tests to comply with Mocha 11’s suite lifecycle APIs while preserving existing lint/test behavior. Flow diagram for ESLint 10 flat config migrationflowchart LR
subgraph Before
A[npm_script_lint<br/>eslint src test --ext js]
B[.eslintrc.json]
C[eslintIgnore in package.json]
A --> B
A --> C
end
subgraph After
D[npm_script_lint<br/>eslint src test]
E[eslint.config.js<br/>flat config]
F[eslint-plugin-import-x<br/>built-in formatting rules]
D --> E
E --> F
end
B -. replaced_by .- E
C -. moved_to .- E
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="eslint.config.js" line_range="14-18" />
<code_context>
+ plugins: {
+ "import-x": importPlugin,
+ },
+ languageOptions: {
+ ecmaVersion: 2022,
+ sourceType: "module",
+ globals: {
+ ...globals.node,
+ ...globals.mocha,
+ ...globals.es2021,
+ },
+ },
</code_context>
<issue_to_address>
**suggestion:** Align `ecmaVersion` and globals to the same ECMAScript year to avoid subtle mismatches.
`ecmaVersion` is set to 2022 but you’re including `globals.es2021`. While this works, it’s inconsistent and may be confusing once newer ES globals are used. Please either switch to `globals.es2022` (or match the year to `ecmaVersion`) or omit the explicit ES globals and rely only on the Node globals for your target runtime.
```suggestion
globals: {
...globals.node,
...globals.mocha,
...globals.es2022,
},
```
</issue_to_address>
### Comment 2
<location path="test/providers/rust_cargo.test.js" line_range="75" />
<code_context>
let clock
suite('testing the golang-go-modules data provider', () => {
+ suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));
+ suiteTeardown(() => clock.restore());
[
</code_context>
<issue_to_address>
**suggestion:** Consider extracting a shared helper for the repeated fake-timer suiteSetup/suiteTeardown patterns
This `suiteSetup`/`suiteTeardown` fake-timer pattern with a fixed date is repeated across this and other provider tests. To improve maintainability and avoid suites drifting (e.g. different dates or a missing `restore()`), consider a shared helper such as `withFixedClock('2023-08-07T00:00:00.000Z', () => { ... })` or `setupFixedClock()`/`teardownClock()` so changes to fake-timer behavior are centralized.
Suggested implementation:
```javascript
let clock;
const FIXED_CLOCK_DATE = '2023-08-07T00:00:00.000Z';
function setupFixedClock() {
clock = useFakeTimers(new Date(FIXED_CLOCK_DATE));
}
function teardownClock() {
clock.restore();
}
```
```javascript
suite('testing the rust-cargo data provider', () => {
suiteSetup(setupFixedClock);
suiteTeardown(teardownClock);
```
```javascript
suite('testing the rust-cargo single crate without ignore', () => {
suiteSetup(setupFixedClock);
```
There are likely other suites in this file (and possibly sibling provider test files) that use the same `suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));` / `suiteTeardown(() => clock.restore());` pattern. Those should also be updated to use `suiteSetup(setupFixedClock);` and `suiteTeardown(teardownClock);` so the fake-timer behavior remains consistent and centrally managed.
Additionally, if the "rust-cargo single crate without ignore" suite (or others) defines its own `suiteTeardown(() => clock.restore());` later in the file, that should be replaced with `suiteTeardown(teardownClock);` to keep teardown logic unified.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Strum355
force-pushed
the
nsantsch/bump-deps-close-542
branch
2 times, most recently
from
June 2, 2026 14:51
ffd0652 to
5956544
Compare
Bump all safe dependencies to latest major versions: - @cyclonedx/cyclonedx-library 6→10, https-proxy-agent 7→9, p-limit 4→7 - chai 4→6, mocha 10→11, sinon 15→22, sinon-chai 3→4 - eslint 8→10, typescript 5→6, which 5→7, @types/node 20→25 Migrate ESLint configuration: - Convert .eslintrc.json to eslint.config.js (flat config, required by ESLint 10) - Replace eslint-plugin-import with eslint-plugin-import-x (ESLint 10 support) - Replace eslint-plugin-editorconfig with equivalent built-in ESLint rules (plugin uses removed context.getFilename API incompatible with ESLint 10) Fix Mocha 11 breaking change: - Convert all suite().beforeAll().afterAll() chains to use suiteSetup()/suiteTeardown() inside suite callbacks (chaining API removed) Add dependabot ignore for packageurl-js (blocked on upstream purl spec issue for '+' encoding in versions, see package-url/packageurl-js#90). Closes guacsec#542 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Strum355
force-pushed
the
nsantsch/bump-deps-close-542
branch
from
June 2, 2026 15:09
5956544 to
3dbfd1c
Compare
Strum355
enabled auto-merge (squash)
June 2, 2026 15:15
ruromero
approved these changes
Jun 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
eslint.config.js) as required by ESLint 10eslint-plugin-importwitheslint-plugin-import-x(ESLint 10 compatible)eslint-plugin-editorconfigwith equivalent built-in ESLint rules (plugin uses removed API)suite().beforeAll().afterAll()chains tosuiteSetup()/suiteTeardown()inside suite callbackspackageurl-js(blocked on upstream purl spec issue)Supersedes #542 — bumps the same deps minus
packageurl-js, and includes the ESLint 10 migration that was blocking the Dependabot PR.Verification
npm run lintproduces identical output (26 errors, 33 warnings — all pre-existing)npm testproduces identical results (406 passing, 35 failing — all pre-existing env-dependent failures from missing tools)Test plan
npm installsucceedsnpm run lintoutput unchangednpm testresults unchanged🤖 Generated with Claude Code
Summary by Sourcery
Upgrade linting and test tooling dependencies and migrate ESLint configuration to the new flat config format while adapting tests and automation to remain compatible.
Build:
Tests: