chore(deps-dev): bump oxlint from 1.76.0 to 1.80.0 - #2769
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) from 1.76.0 to 1.80.0. - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.80.0/npm/oxlint) --- updated-dependencies: - dependency-name: oxlint dependency-version: 1.80.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Dependency Triage:
|
This was referenced Sep 7, 2026
Owner
|
Holding this one — the bump itself is fine, the code it now lints is not. Between 1.76 and 1.80 oxlint added React rules, several in Nothing in the upstream diff is suspect: 1.80.0 is published from GitHub Actions with SLSA provenance, The findings are runtime-behavior ones (a ref read during render, a synchronous setState inside an effect), so they get their own PR rather than being bundled into a dependency bump or silenced by switching the new rules off: #2775. Leaving this open rather than closing it — the judgment is hold, not reject, so no Full analysis of this batch: #2773. |
kompiro
added a commit
that referenced
this pull request
Sep 7, 2026
…sweep The hold in the triage doc assumed a fix PR, then the bump. But the fix PR runs oxlint 1.76, which does not carry the new rules, so its green is not evidence the sweep was complete. Records where the verification actually happens (#2769's CI after the rebase), and makes the local 1.80.0 run the acceptance criterion for the fix PR. Also corrects the finding count: 24 diagnostics over 21 unique sites in 17 files, not 24 sites in 12 files.
kompiro
added a commit
that referenced
this pull request
Sep 7, 2026
Seven of the eight PRs were adopted, one held. Nothing on the supply side: no new publisher, no transferred repo, no new lifecycle script, and not one package name new to the lock. Both CI failures came from the same shape — a declaration Dependabot cannot reach living in the same repo. #2768 moved `@types/vscode` but not `engines.vscode`; ADR-2562 had already settled that the three sites move together, so it lands through replacement PR #2779, which raises the required VS Code to 1.134. #2769 pulls in oxlint's new React rules, which land in correctness and turn 24 diagnostics fatal under `--deny-warnings` with no config change here; it is held while #2775 fixes the sites, and the ADR records why the fix PR's own CI cannot verify that sweep. Deletes the design doc it was promoted from.
6 tasks
Owner
|
Closing in favour of #2784, which carries this bump plus the code and config changes it needs. Working through the findings turned up a coupling that the earlier plan (hold this, fix separately, then rebase) did not survive: oxlint 1.76 rejects the config the fix needs. Three of the 21 sites are the same That is the same conclusion ADR-2333 reached for the 1.61 → 1.76 bump, which I should have cited during the triage instead of rejecting the replacement-PR route on general grounds. ADR-2773 is being corrected accordingly. Nothing was wrong with the bump itself: 1.80.0 is published from GitHub Actions with SLSA provenance, The judgment stays adopt, so no |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
kompiro
added a commit
that referenced
this pull request
Sep 8, 2026
The ADR rejected both the replacement-PR route and the config route for #2769 on general grounds, without citing ADR-2333 — which had reached the opposite conclusion three weeks earlier on the 1.61 to 1.76 bump, for the same reason that surfaced here: the fix has to ride in the same commit as the bump. Implementing #2775 made that concrete. oxlint 1.76 rejects the config the fix needs outright ("Rule 'globals' not found in plugin 'react'"), so the test-file override cannot land ahead of the bump and the bump cannot land ahead of the fix. Bundling was not a preference, it was forced. #2769 moves from hold to adopt via replacement PR #2784. Records the process gap too: dependency triage edits no files, so the `paths:` triggers never fire and the past-decision check only ran when start-dev reached the work — after the triage had been written.
kompiro
added a commit
that referenced
this pull request
Sep 8, 2026
* chore(app): take oxlint 1.80 and fix the React findings it adds Replacement PR for the Dependabot bump in #2769. The bump and the fixes have to share a commit: oxlint 1.76 rejects the config outright with "Rule 'globals' not found in plugin 'react'", so the test-file override below cannot land ahead of it. Between 1.76 and 1.80 oxlint added React rules in `correctness`, which `--deny-warnings` turns fatal here without any config change — 24 diagnostics over 21 sites. Resolved per rule class, the way ADR-2333 did for the 1.61 to 1.76 bump: - react(refs): `useLatestRef` and `use-command` now mirror into the ref from an effect instead of during render; AppShell assigns the parent's recompile ref in an effect and clears it on unmount; ProjectModeApp holds its ProjectManager in lazy state, which also stops it building a throwaway one on every render. - react(set-state-in-effect): ProjectPicker adjusts during render, the theme provider reads the OS setting through useSyncExternalStore, useStyleSource derives its imports, DiffModeBanner derives the active record, and ChatPane resets by remounting on a key rather than through a watched prop. FileTree loads inside an async continuation with a cancellation guard, which also stops a slow load for a directory the user already left from overwriting a newer one. - react(globals) / react(immutability): the three sites are the same RegistryProbe test harness, so the rules are off for test files, extending the override block that already exists for that reason. - dependency arrays: `containingBlock` moves to module scope so the drag callbacks' empty deps are honest, and ChatPane's scroll effect reads `messages.length`. Three remaining deps are triggers the body cannot read, and say so inline. Verified the test-file override does not disable the rules generally: a probe that reassigns an outer binding still errors in a non-test file and is silent in a test file. Closes #2775 * fix(app): key the loaded style to the imports it came from Deriving the imports fixed the effect's synchronous setState but lost what the synchronous clear had been doing: with only a length check guarding the return, a value loaded for one import set was served while a different set was still resolving. An entry that drops its import and then gains another showed the first import's styling in between, and AppShell feeds this straight into useViewSvg, so the preview rendered it. Tags the loaded value with the path and import list it came from and serves it only on a match. Also covers the transition the old code happened to get right, which no test had. Found by CodeRabbit on #2784.
kompiro
added a commit
that referenced
this pull request
Sep 9, 2026
The #2768 section stated "判定は採用" in the present tense while the decision table and the section below it record the final 保留 and the closure of #2779. A reader hitting that line first came away thinking @types/vscode had landed. Says it was the initial judgment and points forward to where it changed, and keeps what did not change: the floor is still going to 1.134, via #2782, only later. The #2769 heading had the same shape — it still announced the separate-PR plan that the bump's config requirement made impossible — so it now names the arc instead of the abandoned plan. Found by CodeRabbit on #2773.
kompiro
added a commit
that referenced
this pull request
Sep 9, 2026
* docs(design): triage the 2026-09-08 Dependabot batch Analyze all eight open Dependabot PRs upstream: registry publisher and provenance, install scripts, lock dependency edges, and GitHub advisories. Nothing on the supply side: no new publisher, no transferred repo, no new lifecycle script, and not one package name new to the lock. Two PRs fail CI, both because a declaration Dependabot cannot reach lives in the same repo. #2768 moves `@types/vscode` but not `engines.vscode`, which the policy guard from ADR-2562 was written to catch; the fix is the replacement PR that ADR already settled on. #2769 pulls in oxlint's new React rules, which land in correctness and turn 24 existing sites fatal under `--deny-warnings`; the recommendation is to hold the bump and fix those sites in their own PR rather than bundle or silence them. The other six are clean and recommended for merge as-is, including the jsdom 29 to 30 major whose only breaking change is a Node floor the repo already clears. * docs(design): note that the oxlint fix PR's own CI cannot verify the sweep The hold in the triage doc assumed a fix PR, then the bump. But the fix PR runs oxlint 1.76, which does not carry the new rules, so its green is not evidence the sweep was complete. Records where the verification actually happens (#2769's CI after the rebase), and makes the local 1.80.0 run the acceptance criterion for the fix PR. Also corrects the finding count: 24 diagnostics over 21 unique sites in 17 files, not 24 sites in 12 files. * docs(adr): promote the 2026-09-08 Dependabot triage to ADR-2773 Seven of the eight PRs were adopted, one held. Nothing on the supply side: no new publisher, no transferred repo, no new lifecycle script, and not one package name new to the lock. Both CI failures came from the same shape — a declaration Dependabot cannot reach living in the same repo. #2768 moved `@types/vscode` but not `engines.vscode`; ADR-2562 had already settled that the three sites move together, so it lands through replacement PR #2779, which raises the required VS Code to 1.134. #2769 pulls in oxlint's new React rules, which land in correctness and turn 24 diagnostics fatal under `--deny-warnings` with no config change here; it is held while #2775 fixes the sites, and the ADR records why the fix PR's own CI cannot verify that sweep. Deletes the design doc it was promoted from. * docs(adr): change #2768 from adopt to hold in ADR-2773 Applying the triage turned up a constraint the analysis had missed. `extester-bootstrap.mjs` calls `downloadCode("max")`, and `max` resolves to the highest VS Code the pinned `vscode-extension-tester` declares support for — 1.131.0 on 8.24.0 — so `engines.vscode` cannot exceed it. Replacement PR #2779 failed on exactly that and is closed. Raising the floor therefore needs an ExTester bump, and both candidates break a policy: 8.25.0 clears cooldown but adds `extract-zip@2.0.1`, which carries an unpatched high advisory (CVE-2026-56876) that upstream itself backed away from in 8.26.0; 8.26.0 is clean but one day old. Deferring to 2026-09-14 breaks neither and costs six days of a type bump, so #2768 becomes a hold folded into #2782. Also records that this second constraint on the floor has no machine check, unlike the equality one. * docs(adr): correct the overrides claim in ADR-2773 Both this ADR and ADR-2753 said `pnpm-workspace.yaml`'s `overrides:` is empty, so `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` could not occur. That check read `package.json`'s `pnpm.overrides`, which pnpm 11 ignores — the source of truth is `pnpm-workspace.yaml`, exactly as `.claude/rules/dependabot.md` warns. It holds 23 floors, five of them touching this batch. Redone properly, every resolved version clears its floor, which matches CI staying green on `--frozen-lockfile`. So the outcome stands and the stated reason does not: it is "the floors were satisfied", not "there are no floors". ADR-2753 carries the same false sentence, and the svgo it merged is on the override list — the "direct dependency with an override" shape the rules call out. Its body stays as written (ADR-2687), so the correction lives here. Found by CodeRabbit on #2773. * docs(adr): correct ADR-2773 for the ADR-2333 precedent it missed The ADR rejected both the replacement-PR route and the config route for #2769 on general grounds, without citing ADR-2333 — which had reached the opposite conclusion three weeks earlier on the 1.61 to 1.76 bump, for the same reason that surfaced here: the fix has to ride in the same commit as the bump. Implementing #2775 made that concrete. oxlint 1.76 rejects the config the fix needs outright ("Rule 'globals' not found in plugin 'react'"), so the test-file override cannot land ahead of the bump and the bump cannot land ahead of the fix. Bundling was not a preference, it was forced. #2769 moves from hold to adopt via replacement PR #2784. Records the process gap too: dependency triage edits no files, so the `paths:` triggers never fire and the past-decision check only ran when start-dev reached the work — after the triage had been written. * docs(adr): mark #2768's adopt as the judgment it started at The #2768 section stated "判定は採用" in the present tense while the decision table and the section below it record the final 保留 and the closure of #2779. A reader hitting that line first came away thinking @types/vscode had landed. Says it was the initial judgment and points forward to where it changed, and keeps what did not change: the floor is still going to 1.134, via #2782, only later. The #2769 heading had the same shape — it still announced the separate-PR plan that the bump's config requirement made impossible — so it now names the arc instead of the abandoned plan. Found by CodeRabbit on #2773.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps oxlint from 1.76.0 to 1.80.0.
Release notes
Sourced from oxlint's releases.
... (truncated)
Changelog
Sourced from oxlint's changelog.
... (truncated)
Commits
97e99b8release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)0db127crelease(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)228e8e0fix(linter): resolve inactive React compiler rules (#25830)aa49d86fix(linter): allow spread rule options in config types (#25675)8922381refactor(linter): remove inactive react config rule (#25740)8c4552dfeat(linter)!: split react/react-compiler into per-category rules (#25500)36f8451fix(linter/eslint/no-eval): align indirect default with ESLint (#25656)beb724dfix(linter/eslint/no-unused-vars): report bare underscore parameters (#25663)4004c10fix(linter/eslint/no-irregular-whitespace): check comments by default (#25660)285820efix(linter/no-large-snapshots): precompile and document allowed snapshot matc...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)