Repository navigation
chore(samples): v1.x housekeeping (lint scope, webpack dev server, npm audit fix) - #302
Open
imdt-claudiop wants to merge 5 commits into
Open
imdt-claudiop wants to merge 5 commits into
imdt-claudiop wants to merge 5 commits into
Conversation
eslint ./src/* only reached nested files when the shell expanded the glob; when ESLint expands it (quoted, or a shell without globbing) it stops at the first level. eslint src always walks the whole tree. build:watch in four samples deleted dist, where webpack writes the bundle, and then ran tsc in watch mode into dist-tsc, so it never produced a loadable plugin. Nothing calls it. Co-Authored-By: Guilherme Pereira Leme <69865537+GuiLeme@users.noreply.github.com>
Four samples (generic-content-sidekick, media-area, server-commands and user-list-dropdown) still declared eslint-watch and lint-staged, and no script in them calls either. They also block the audit fix: with them installed, npm audit fix --force downgrades eslint-watch from 8 to 3.1.3, a release that requires ESLint below 5. The root package dropped the same two dev dependencies earlier for the same reason. Co-Authored-By: Guilherme Pereira Leme <69865537+GuiLeme@users.noreply.github.com>
webpack-dev-server 5 removed onBeforeSetupMiddleware and refuses to start when the option is present, so npm start fails in every sample once the dev server moves to 5. setupMiddlewares has existed since 4.7, so the same route now works on the 4.15 the samples lock today and on 5. Co-Authored-By: Guilherme Pereira Leme <69865537+GuiLeme@users.noreply.github.com>
…t-eslint 8 The webpack configs are CommonJS and turn off @typescript-eslint/no-var-requires for that. @typescript-eslint 8 replaces that rule with no-require-imports in its recommended set, so once a sample installs version 8, npm run lint at the root fails on the six samples that have their own .eslintrc. Disabling both names keeps the configs clean under 6 and 8. Co-Authored-By: Guilherme Pereira Leme <69865537+GuiLeme@users.noreply.github.com>
One npm audit fix --force per sample, followed by a plain npm audit fix that only moved lockfile entries. The forced pass takes @typescript-eslint from 6 to 8, copy-webpack-plugin from 12 to 14 and webpack-dev-server from 4 to 5. It ran once on purpose: a second forced pass downgrades webpack-dev-server to 2.9.7 and raises the count instead of lowering it. Two samples needed one more step to end in the same place as the rest. In generic-content-sidekick the forced pass left @typescript-eslint on 6.21, which is still affected, so it was raised to the same 8.71.1 by hand. In floating-window the fix moved styled-components to 6.5.3, whose types need TypeScript 5.4 and no longer pull in @types/stylis, so TypeScript and @types/node were refreshed within their declared ranges and @types/stylis became a direct dev dependency. Every sample goes from 51 to 54 advisories down to 7. The 7 left all come from webpack-dev-server, a dev-only tool that is not part of the plugin bundle: braces has no patched release, uuid is pinned by sockjs, and npm can only clear them by downgrading webpack-dev-server to 2.9.7. Co-Authored-By: Guilherme Pereira Leme <69865537+GuiLeme@users.noreply.github.com>
1 task done
Arthurk12
self-requested a review
October 13, 2026 13:30
Arthurk12
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Housekeeping for the sample plugins on the v1.x line:
srcrecursively in all 23 samples and drops the brokenbuild:watchscript from the 4 samples that had iteslint-watchandlint-stageddevDependencies from the samples that had themonBeforeSetupMiddleware(removed in webpack-dev-server 5) tosetupMiddlewaresin every sample's webpack.config.jsrequire()inwebpack.config.jsunder@typescript-eslint8npm audit fixacross the samples, moving @typescript-eslint to 8, copy-webpack-plugin to 14 and webpack-dev-server to 5 (1202 -> 161 advisories, no downgrades, no rollbacks)Closes Issue(s)
None.
Motivation
Follow-up housekeeping after the v1.x line opened; the samples carried stale lint scopes, webpack workarounds and vulnerable transitive dependencies.
More
tscand lint for all 23 samples via./scripts/validate-samples-code.sh, plusnpm run build-bundlein each of the 23 samples.npm audit fixresult was verified per sample:npm ci, build, and a manual smoke of the plugins without automated tests (meeting as moderator, plugin loaded with emptyloadFailureReason, no plugin errors in the console); about 9 of the 17 untested plugins were also inspected visually via screenshots.