chore(deps): eslint-config-next 16 — native flat config, drop FlatCompat - #37
Merged
Conversation
The achievable half of #15. eslint-config-next 16 ships native flat configs, so FlatCompat and the direct @eslint/eslintrc dep go away. eslint itself stays on latest 9.x: eslint 10 is blocked upstream — eslint-plugin-react (7.37.5, bundled by config-next) peer-caps at ^9.7 and uses the removed context.getFilename API (verified: crashes on rule load). The bundled react-hooks v7 adds five React-Compiler-era rules as errors; the codebase carries 27 deliberate pre-compiler idioms across 17 files, so those rules are set to warn (tracked follow-up) instead of mixing a behavioral refactor into a deps bump. rules-of-hooks and exhaustive-deps stay errors. The brace-expansion advisory (GHSA-mh99-v99m-4gvg) itself is not clearable today: published yesterday, patched only in 5.0.8 with no backports, and 5.x's CJS namespace export breaks every minimatch ≤ 3 consumer (an overrides pin was tried — every lint run crashes). Dev-only tooling; risk posture unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 25, 2026
tbcsec
added a commit
that referenced
this pull request
Jul 25, 2026
main's Docker image build is failing: react-hooks/purity (new in the react-hooks v7 that eslint-config-next 16 brought in via #37) errors on the Date.now() call added in #41's archive confirm dialog, because the component body counts as render scope. Neither PR's CI could catch it — #41 branched before #37 merged, so it linted against react-hooks v5 where the rule didn't exist, and #37 never saw #41's code. A semantic merge conflict that only exists on main. Hoists the description builder to a module-level archiveWarning(); the rule only analyzes component/hook bodies, and the copy reads better extracted. Deliberately not a rule downgrade — it caught a real purity violation. Also drops a stale comment claiming archive/delete aren't wired. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
tbcsec
added a commit
that referenced
this pull request
Jul 26, 2026
Guards the failure mode that broke main after #41: two PRs that are each green can still break main together, when one adds a lint rule and the other adds a violation of it. GitHub does build the merge result for pull_request events — but it computes that merge ref when the PR is pushed and never recomputes it as the base moves. #41's run therefore tested itself merged into a main that predated #37's eslint upgrade, so the rule that would have caught its Date.now() call didn't exist yet in that checkout. Both PRs were green; only their combination was broken, and the image build on main was the first job to see it. The new job merges origin/main as of the moment it runs, so re-running it answers "would this break main right now?" — unlike the other jobs, whose answer is frozen at push time. Lint + build only: this is aimed at cross-PR tooling drift, which is exactly what the build surfaces, and the full suites already run on the branch. Verified against the real history: a worktree at #41's head merged with #37 reproduces `64:15 Cannot call impure function during render` and exits non-zero — the exact error that reached main. Co-authored-by: ci <ci@x> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Progresses #15 — with one finding that changes its endgame (commented on the issue).
What changed
eslint-config-next15.5 → 16.2.12 (the major [Dependency] Upgrade eslint / eslint-config-next to clear the brace-expansion advisory #15 asked for): it now ships native flat configs, soeslint.config.mjsimports them directly and theFlatCompatshim + the direct@eslint/eslintrcdevDependency are gone.eslintstays on latest 9.x (9.39.5) — the 10.x half of [Dependency] Upgrade eslint / eslint-config-next to clear the brace-expansion advisory #15 is blocked upstream: the latesteslint-plugin-react(7.37.5, which config-next 16 bundles) peer-caps at eslint^9.7and still callscontext.getFilename(), an API eslint 10 removed. Verified empirically — eslint 10 crashes on rule load.rules-of-hooks/exhaustive-depsstay errors.The advisory (the actual point of #15) is not clearable today
GHSA-mh99-v99m-4gvg published 2026-07-24 — patched only in
brace-expansion@5.0.8, no 1.x–4.x backports. Everyminimatch ≤ 10.0.2in the ecosystem (eslint 9 core,@eslint/config-array, config-next's bundled plugins) requires brace-expansion as a bare CJS function; 5.x exports a namespace. Anoverridespin to 5.0.8 was tried and breaks every lint run (TypeError: expand is not a function), so it's reverted.npm auditstill reports the one advisory via 9 dev-only paths; there is no fix path anywhere in the ecosystem yet (no post-advisory minimatch releases as of today).Dev-only lint tooling, never shipped to production — unchanged risk posture from when #15 was filed.
Verification
npx eslint .— 0 errors (27 tracked warnings)npm run test— 109 passed ·npx tsc --noEmitclean ·npm run buildclean🤖 Generated with Claude Code