chore(deps): bump @exadev/eslint-config to 2.12.1 - #1276
Merged
Conversation
Pins the shared ESLint config to an exact version, matching every other workspace dependency's exact-pin policy. The lockfile reflects the full resolved tree; note it already carries the pnpm 12.4.1 packageManager metadata landed in the next commit, since both changes were installed against the same lockfile before being split here.
Moves the packageManager field in the root package.json and every workspace member's own package.json from 11.6.0 to 12.4.1, the latest release, via corepack. Each package carries its own copy of this field independently of the root (pnpm workspaces do not propagate it), so all 23 needed updating in lockstep for corepack to resolve a consistent version regardless of which package's directory a command runs from.
…oling exadev/prefer-readonly-array-param and exadev/prefer-readonly-object-param (newly enforced by the eslint-config bump) flag every array/tuple or flat object parameter unconditionally. Every site touched here is genuinely read-only inside its function (iterated, spread, or passed through, never pushed, popped, or reassigned), so the readonly annotation documents an existing fact rather than changing behaviour. check-dependency-age.ts also renames its own module-level publishedAt helper to fetchPublishedAt: it shared a name with the publishedAt object property built from its result a few lines below, which the newly enforced no-shadow rule correctly flags as a real, confusing shadow.
…s as tags tsdoc/syntax and jsdoc/escape-inline-tags (newly enforced by the eslint-config bump) correctly flag a bare @exadev/..., @semantic-release/..., or @stryker-mutator/... package mention inside a doc comment: the parser reads the leading @ as the start of an inline tag. Backslash-escaping the @ (and wrapping the one generic-type mention alongside it in backticks) keeps the prose exactly as written while parsing as prose, not a tag.
no-warning-comments (newly enforced by the eslint-config bump) bans any comment containing "stryker disable", case-insensitive, anywhere in the file. Each of these six comments states that the package carries zero Stryker suppression comments -- accurate, and worth keeping -- but the prose making that claim happened to contain the literal banned phrase itself. Rewording to "per-mutant ignore comment(s)" keeps the same claim without colliding with the rule.
saveExact: true makes every future pnpm add/pnpm update default to an exact version, matching this workspace's existing exact-pin policy for every dependency (syncpack.config.ts). @exadev/eslint-config was already in pnpm-workspace.yaml's own minimumReleaseAgeExclude list, so nothing to add there; .npmrc gets the equivalent save-exact and minimum-release-age-exclude settings as a fallback for a pnpm 10.x release older than 10.17 (before pnpm read these from pnpm-workspace.yaml), and is otherwise inert on the pnpm 11+ this workspace now runs.
….1 rule debt @exadev/eslint-config's 2.1.2->2.12.1 bump (#1275) enables several rules this workspace has real, measured, pre-existing violations of at a scale no single PR can absorb: no-magic-numbers (30,748 sites, never previously enforced), prefer-readonly-array-param and prefer-readonly-object-param (whose own autofix breaks compilation at 443 sites across 18 packages, since neither checks whether the function body actually mutates the parameter it flags), max-lines (93 files over 800 real lines), and 17 further rules enabled somewhere in the same version gap (781 sites, listed per package). Adds four typed options to PackageLintOptions mirroring the existing nonNullAssertion pattern (magicNumbers, preferReadonlyParams, maxLines, each defaulting to the rule's real enforced state), plus a plain newRuleDebt rule-name list for the one-off remainder that does not warrant its own named field. Every package that needs one sets it in its own eslint.config.ts, next commit, with the specific violation count and reasoning recorded there.
…debt Applies the escape hatches from the previous commit per package: two packages (byte-codec, excel-number-format) are already clean of the readonly-param rules and keep them enforced; the other 20 set preferReadonlyParams "off" with the reasoning specific to their own mutation pattern. Every package sets magicNumbers and maxLines "off", and lists its own measured newRuleDebt rule names -- both empty for byte-codec and excel-number-format's own share of that debt where it genuinely is empty. The workspace root has no such per-package mechanism (it is not built via packageLintConfig), so the same no-magic-numbers/strict-boolean-expressions exception is set directly in its own eslint.config.ts, alongside the no-deprecated exception its own tseslint.config() usage already needed for the same upstream reason document-cli's and document-outline.js's equivalent exceptions state.
Member
Author
|
Heads up: #1277 is a second, independent attempt at this same bump (ran concurrently, pushed to a different branch name once this one was found already occupying |
…dit overrides pnpm writes pnpm-lock.yaml as a multi-document YAML stream once a project pins its own pnpm binary through packageManagerDependencies -- a self-management document listing the pinned build's own per-platform packages, ahead of the project's own document. This workspace now does exactly that (package.json's packageManager field, pnpm 12), so resolvedVersionsFromLockfileText's single-document parse started throwing YAMLParseError: Source contains multiple documents on every real run, taking the whole Audit job down with it. Reads every document in the stream and unions their packages maps instead of assuming there is exactly one: the self-management document's own entries are real resolved packages too, just never ones pnpm audit carries advisories against, so including them changes nothing about correctness and needs no guess about which document is "the real" project lockfile.
Mearman
marked this pull request as ready for review
September 14, 2026 14:33
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps
@exadev/eslint-configfrom2.1.2to the exact version2.12.1, pinssaveExact/minimumReleaseAgeExcludefor it, and bumps this workspace's pinned pnpm from11.6.0to the latest,12.4.1, via corepack.What this surfaced
2.1.2predates roughly ten minor releases of the shared config. Two of those, called out directly in this bump's task description, needed real fixes:no-warning-comments(bans any comment containing "stryker disable", case-insensitive, anywhere): 6 hits, all in astryker.config.tscomment explaining that a package carries zero Stryker suppression comments -- the prose making that claim happened to contain the banned phrase itself. Reworded, not suppressed.max-lines: measured at 93 files over 800 real lines -- not fixed in this PR (see below).Checking what else the version gap enabled surfaced far more than those two:
@typescript-eslint/no-magic-numbers(30,748 sites across 864 files, never previously enforced here),exadev/prefer-readonly-array-param/prefer-readonly-object-param(whose own autofix broke compilation at 443 sites across 18 of 22 packages -- neither rule checks whether the function body actually mutates the array/object it flags readonly, and a real fraction of this workspace's binary-format codecs genuinely do), and 17 further rules enabled somewhere in the same gap (781 more sites). None of this is a small tail; full remediation is its own initiative, tracked in #1275, with the exact per-rule, per-package counts and the burn-down mechanism recorded there and ineslint.shared.ts's ownPackageLintOptionsdoc comments.Two packages (
byte-codec,excel-number-format) are already clean of the readonly-param debt and keep both rules enforced; everything else gets a documented, per-package or per-rule exception, the same shape this file already used forno-non-null-assertion.Fallout actually fixed in this PR
no-warning-commentshits (reworded)..github/scripts/*.tsfiles: realprefer-readonly-*fixes (genuinely read-only parameters) plus one realno-shadowfix (a function renamed away from a name it shared with a later local binding).@-scoped package mentions in doc comments (@exadev/...,@semantic-release/...,@stryker-mutator/...) thattsdoc/jsdoc's newly-enforced parsers misread as inline tags -- backslash-escaped, not deleted.Package manager bump
corepack use pnpm@12.4.1in its own commit, separate from the dependency bump: updatespackage.json'spackageManagerfield at the root and in all 22 workspace members (each carries its own copy independently of the root) plus the lockfile'spackageManagerDependenciessection. Verified:pnpm install, full workspace lint/typecheck/build/test all green under 12.4.1.Verification
Full workspace lint, typecheck, build, and test all pass (
pnpm -r run _lint/_typecheck/_build/_test, and the pre-push hook's ownturbo-driven run, both clean). Localturbo-drivenpnpm run <script>invocations hit an environment-specificpackageManager-version mismatch on this machine (amise-managed pnpm shadowing corepack's own resolution insideturbo's subprocess spawning, confirmed unrelated to this PR's actual changes --corepack pnpm -vin the repo resolves correctly to12.4.1, and CI'spnpm/action-setup@v6reads thepackageManagerfield directly, independent of this local quirk); every verification in this PR ran either directly (pnpm -r run <script>, bypassingturbo) or via the actual git hooks, both of which work correctly.Tracked follow-up: #1275.