Repository navigation
chore(lint): upgrade to ESLint 10 - #22
Conversation
Dependencies
- eslint ^9.39.4 -> ^10.12.0.
- eslint.config.mjs imports @eslint/js, typescript-eslint and
eslint-plugin-react-hooks but none were declared; they resolved only as
transitive deps (ESLint 9 bundled @eslint/js, eslint-config-next pulled
the other two). ESLint 10 stopped bundling @eslint/js, so lint crashed
with ERR_MODULE_NOT_FOUND. All three are now explicit devDependencies.
- Removed eslint-config-next: never wired into the flat config (see
AgentOS_OutOfScope_Backlog.md), and its eslint-plugin-import / jsx-a11y /
react peers don't accept ESLint 10, which blocked the install. Dropping it
removes ~200 packages and the last npm audit advisory (braces, reached via
fast-glob/micromatch), so npm audit is now clean.
- Removed unused @eslint/eslintrc (no FlatCompat usage anywhere).
- eslint.config.mjs is unchanged.
Code (new ESLint 10 recommended rules; 20 errors -> 0)
- no-useless-assignment (17): dropped placeholder initialisers that are
always overwritten in a try block or whose catch returns. Purely
declarative; tsc's definite-assignment analysis verifies every variable
is still assigned before use.
- preserve-caught-error (3): evalCorpus.ts / evalRunner.ts rethrows now pass
the original error as { cause: e }. Messages are unchanged.
dependabot.yml: drop eslint-config-next from next-react; lint group now
also covers eslint-plugin-* and typescript-eslint.
Verified: npm ci, typecheck, lint (0 errors, same 10 pre-existing
warnings), 406 tests passed, eval 174/174, next build, npm audit 0, CI's
R1.4 AST step (0 hits over 280 files) and a planted node:child_process
import in src/app still reported by no-restricted-imports.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KddPyDgHXVotgYiCUfYS3e
ECC Tools / Security EvidenceCommit: Security scanner evidence required (action_required) Detected 1 security-sensitive predictive risk signal(s) without scanner evidence. Mode: enforce Findings:
Touched security-sensitive paths:
Expected evidence:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy review recommended (neutral) Detected 4 PR taxonomy bucket(s): Security Evidence, Install Manifest Integrity, CI/CD Recommendation, RAG/Evaluator Evidence. Scanned 20 changed file(s). Roadmap taxonomy buckets: Security EvidenceSecurity-sensitive changes should carry explicit scanner, code-scanning, or focused regression evidence. Signals:
Paths:
Install Manifest IntegrityInstall manifests, plugin metadata, and shipped skills should stay synchronized with user-facing setup guidance. Signals:
Paths:
CI/CD RecommendationCI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work. Signals:
Paths:
RAG/Evaluator EvidenceRAG, retrieval, embedding, ranking, and evaluator changes should be compared against reference sets, golden traces, benchmarks, or eval runs. Signals:
Paths:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 0/7 areas (0%) across 20 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (19)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 20 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (21 files)
Previous Review Summary (commit e5b6841)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit e5b6841)Status: No Issues Found | Recommendation: Merge Files Reviewed (20 files)
Reviewed by free · Input: 757.3K · Output: 22.5K · Cached: 388.9K |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).
Graphify review — findings
Upgrades ESLint to v10, replacing eslint-config-next and @eslint/eslintrc with a lint setup built from @eslint/js, typescript-eslint, and eslint-plugin-react-hooks. Dependabot's lint group now also batches eslint-plugin-* and typescript-eslint updates, and eslint-config-next is dropped from the next-react group since it's no longer a dependency. The lockfile refresh also picks up minor Babel patch bumps.
Review partial — this diff was larger than one review pass covers, so later files were not reviewed; some findings may be missing.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 313 functions depend on the 251 functions this change touches.
Health — this change adds coupling hotspots:
- new:
tunnelStatus()— 4 callers, 5 callees - new:
mutate()— 5 callers, 3 callees - new:
providerStatus()— 4 callers, 3 callees - new:
buildArtifact()— 0 callers, 7 callees - new:
POST()— 0 callers, 6 callees
Verification — 313 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 306 function(s) in the blast radius were not formally verified this run
· 5 more finding(s) on lines outside this diff (see the check run).
ESLint 10 declares engines `^20.19.0 || ^22.13.0 || >=24`, so the old `>=22.5` floor (the node:sqlite minimum) let Node 22.5-22.12 users install a dev toolchain that does not support them; with engine-strict, `npm ci` fails. Raised engines.node to >=22.13 and updated the DISTRIBUTION.md build prerequisite. The node:sqlite runtime notes (22.5+) stay accurate. Raised by Greptile review on #22. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KddPyDgHXVotgYiCUfYS3e
ECC Tools / Security EvidenceCommit: Security scanner evidence required (action_required) Detected 1 security-sensitive predictive risk signal(s) without scanner evidence. Mode: enforce Findings:
Touched security-sensitive paths:
Expected evidence:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy review recommended (neutral) Detected 4 PR taxonomy bucket(s): Security Evidence, Install Manifest Integrity, CI/CD Recommendation, RAG/Evaluator Evidence. Scanned 21 changed file(s). Roadmap taxonomy buckets: Security EvidenceSecurity-sensitive changes should carry explicit scanner, code-scanning, or focused regression evidence. Signals:
Paths:
Install Manifest IntegrityInstall manifests, plugin metadata, and shipped skills should stay synchronized with user-facing setup guidance. Signals:
Paths:
CI/CD RecommendationCI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work. Signals:
Paths:
RAG/Evaluator EvidenceRAG, retrieval, embedding, ranking, and evaluator changes should be compared against reference sets, golden traces, benchmarks, or eval runs. Signals:
Paths:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 0/7 areas (0%) across 21 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 21 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
|
Generated by Claude Code |
This branch was successfully deployed
2 participants
Summary
Upgrades ESLint 9 → 10 and fixes everything that blocked it. Replaces Dependabot's #19, which fails because ESLint 10 no longer ships
@eslint/js. Side effect:npm auditnow reports 0 vulnerabilities.Changes
Dependencies (
eslint.config.mjsitself is unchanged)eslint^9.39.4 → ^10.12.0.eslint.config.mjsimports@eslint/js,typescript-eslintandeslint-plugin-react-hooks, but none of them were declared inpackage.json. They only worked because ESLint 9 shipped@eslint/jsandeslint-config-nextpulled in the other two. They're now explicit devDependencies.eslint-config-next. It was never wired into the config (seeAgentOS_OutOfScope_Backlog.md). Three plugins it pulls in (eslint-plugin-import,jsx-a11y,react) don't support ESLint 10, which blocked the install. Removing it drops about 200 packages, including the lastnpm auditadvisory (braces, which came in throughfast-globandmicromatch).@eslint/eslintrc, which isn't used anywhere.Code: two rules ESLint 10 added to its recommended set (20 errors → 0)
no-useless-assignment(17 places): removed placeholder initial values that are always overwritten in atryblock, or where thecatchreturns. Behavior doesn't change, and TypeScript's typecheck confirms each variable is still assigned before use. 14 files, one line each.preserve-caught-error(3 places): the rethrows inevalCorpus.tsandevalRunner.tsnow pass the original error as{ cause: e }. Error messages are unchanged.dependabot.yml: removedeslint-config-nextfrom thenext-reactgroup; thelintgroup now also coverseslint-plugin-*andtypescript-eslint.Testing
npm run typechecknpm run lint: 0 errors (the same 10 existing react-hooks warnings)npm test: 406 passed, 2 skippednpm run eval: 174/174npm run buildSecurity checklist
child_processimports insrc/app/**orsrc/features/**. CI's R1.4 lint step reports 0 hits across 280 files, and a deliberately addednode:child_processimport insrc/appis still flagged byno-restricted-imports.envfiles or personal config committed🤖 Generated with Claude Code
https://claude.ai/code/session_01KddPyDgHXVotgYiCUfYS3e
Generated by Claude Code
Summary by CodeRabbit
Chores
Bug Fixes
The PR appears safe to merge based on the reviewed changes.
Summary
The PR upgrades ESLint to 10, declares the lint configuration’s dependencies explicitly, removes unused lint dependencies, and adjusts code for newly recommended rules. Since the previous review, it also raises the build-time Node minimum to 22.13 and upgrades Framer Motion to 13.
Reviews (2) · Last reviewed commit: "chore: raise Node engine floor to 22.13 ..."