BREAKING: Bump ESLint to ^9.11.1, bump related ESLint dependencies, and rewrite configs to use flat configs

[Mrtenz]

ESLint 8 will be end-of-life from 2024-10-05. ESLint 8 introduced a new config format, which is now the default in ESLint 9, and only opt-out through an environment flag. We could enable that flag and keep the current configs, but it's better to just update the configs now and be done with it.

I've updated all configs to use the new format. The most notable changes are:

• All ESLint-related dependencies are now on the latest version.
• All configs now use ESM, as this is now supported out-of-the-box in ESLint 9.
• I've updated the default ECMAScript version to 2022, which is in line with what the MetaMask extension supports.
• Each config now includes a TypeScript declaration file to support type-checking.

Closes #362.

Breaking changes

All configs

• All packages are now pure ESM, and cannot be imported from a CJS configuration.
  • ESLint 9 supports ESM configurations out of the box.
• The minimum ESLint version is now ^9.11.0, and all configs were updated to use the flat config format.
  • See the migration guide for more information.
• All dependencies have been updated, so some rules have been replaced or removed.

@metamask/eslint-config-typescript

• @typescript-eslint/parser and @typescript-eslint/eslint-plugin are replaced with typescript-eslint@^8.6.0, which is now a peer dependency.
• For proper linting using type information, languageOptions.parserOptions.tsconfigRootDir must be set to the current directory, e.g., using import.meta.dirname.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@ampproject/[email protected]	None	0	76 kB	jridgewell
npm/@babel/[email protected]	None	0	4.13 kB	nicolo-ribaudo
npm/@babel/[email protected]	None	0	6.86 kB	nicolo-ribaudo
npm/@es-joy/[email protected]	None	0	121 kB	brettz9
npm/@eslint-community/[email protected]	None	0	446 kB	eslint-community-bot
npm/@eslint/[email protected]	None	0	113 kB	eslintbot
npm/@eslint/[email protected]	filesystem, unsafe	0	668 kB	eslintbot
npm/@eslint/[email protected]	None	0	14.2 kB	eslintbot, openjsfoundation
npm/@eslint/[email protected]	None	0	55.5 kB	eslintbot
npm/@eslint/[email protected]	None	0	76.7 kB	eslintbot
npm/@humanwhocodes/[email protected]	None	0	44.3 kB	nzakas
npm/@types/[email protected]	None	0	3.17 kB	types
npm/@types/[email protected]	None	0	196 kB	types
npm/@types/[email protected]	None	0	31.7 kB	types
npm/@types/[email protected]	None	0	2.2 MB	types
npm/@typescript-eslint/[email protected]	None	0	2.63 MB	bradzacher, jameshenry
npm/@typescript-eslint/[email protected]	None	0	18.7 kB	jameshenry
npm/@typescript-eslint/[email protected]	None	0	602 kB	jameshenry
npm/@typescript-eslint/[email protected]	None	0	121 kB	jameshenry
npm/@typescript-eslint/[email protected]	None	0	171 kB	jameshenry
npm/@typescript-eslint/[email protected]	None	0	588 kB	jameshenry
npm/@typescript-eslint/[email protected]	None	0	282 kB	jameshenry
npm/@typescript-eslint/[email protected]	None	0	19.5 kB	bradzacher, jameshenry
npm/[email protected]	None	0	538 kB	marijn
npm/[email protected]	environment, filesystem	0	63 kB	ai
npm/[email protected]	None	0	2.1 MB	ai, beneb, caniuse-lite
npm/[email protected]	environment	0	42.1 kB	qix
npm/[email protected]	None	0	148 kB	kilianvalkhof
npm/[email protected]	unsafe	0	212 kB	evilebottnawi
npm/[email protected]	None	0	90.9 kB	guybedford
npm/[email protected]	None	0	20.8 kB	lydell
npm/[email protected]	None	0	683 kB	jounqin
npm/[email protected]	filesystem	0	349 kB	aaronabramov, jeysal, jsonp, ...6 more
npm/[email protected]	None	0	2.08 MB	gajus
npm/[email protected]	None	0	437 kB	eslint-community-bot, weiran.zsd
npm/[email protected]	None	0	34.3 kB	jounqin
npm/[email protected]	None	0	77.7 kB	eslint-community-bot
npm/[email protected]	None	0	148 kB	eslintbot
npm/[email protected]	environment	0	3.3 MB	eslintbot
npm/[email protected]	None	0	76.5 kB	eslintbot
npm/[email protected]	None	0	1.04 MB	michaelficarra
npm/[email protected]	filesystem	0	16 kB	jaredwray
npm/[email protected]	filesystem	0	29.3 kB	jaredwray
npm/[email protected]	None	0	40.3 kB	webreflection
npm/[email protected]	filesystem	0	105 kB	hirokiosame
npm/[email protected]	None	0	174 kB	sindresorhus
npm/[email protected]	None	0	25.1 kB	sindresorhus
npm/[email protected]	environment, filesystem	0	32.5 kB	isaacs
npm/[email protected]	None	0	53.6 kB	kael
npm/[email protected]	None	0	245 kB	jsdoc-type-pratt-parser
npm/[email protected]	None	0	5.4 kB	dominictarr
npm/[email protected]	None	0	27.8 kB	jaredwray
npm/[email protected]	None	0	6.72 kB	styfle
npm/[email protected]	environment, shell	0	1.85 MB	nodejs-foundation
npm/[email protected]	None	0	39.1 kB	tomeraberbach
npm/[email protected]	None	0	5.55 kB	matzkoh
npm/[email protected]	environment, filesystem, unsafe	0	7.7 MB	prettier-bot
npm/[email protected]	None	0	26 kB	chrisackerman
npm/[email protected]	network	0	156 kB	joshglazebrook
npm/[email protected]	None	0	33.3 kB	keithamus
npm/[email protected]	None	0	5.46 kB	quietshu
npm/[email protected]	environment	0	55.7 kB	jounqin
npm/[email protected]	None	0	46.9 kB	sokra
npm/[email protected]	None	0	86.2 kB	typescript-bot
npm/[email protected]	None	0	99.5 kB	jameshenry

🚮 Removed packages: npm/@eslint-community/[email protected], npm/@eslint/[email protected], npm/@eslint/[email protected], npm/@humanwhocodes/[email protected], npm/@humanwhocodes/[email protected], npm/@typescript-eslint/[email protected], npm/@typescript-eslint/[email protected], npm/@typescript-eslint/[email protected], npm/@typescript-eslint/[email protected], npm/@typescript-eslint/[email protected], npm/@typescript-eslint/[email protected], npm/@typescript-eslint/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

[socket-security]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/[email protected], npm/[email protected]

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

[Mrtenz]

@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]

Network access expected.

@SocketSecurity ignore npm/@npmcli/[email protected]
@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]

New author is ok.

@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/@npmcli/[email protected]
@SocketSecurity ignore npm/[email protected]

Deprecated is ok.

@SocketSecurity ignore npm/[email protected]

Seems like a false positive.

[Mrtenz]

This script doesn't have the same functionality as the previous script. It's a bit hard to follow what exactly it was doing, so for the time being, this script simply checks and writes snapshots.

[MajorLift]

Is this safe because consumers always use this package as a devDep? Are we sure this doesn't affect downstream CJS packages?

[MajorLift]

Looking at the eslint v9 migrate guide, looks like we only need to worry about CJS configurations importing from our repo, and that shouldn't be a problem for long since eslint is now set up to use ESM by default?

[Mrtenz]

Consumers can add it and use it even if they use type: commonjs, as long as the config is a .mjs file. I figured we might as well update all places where we consume the libraries since we have to rewrite the majority of the configs anyway.

[MajorLift]

@metamaskbot publish-preview

[Mrtenz]

@SocketSecurity ignore npm/[email protected]

New author is ok.

[MajorLift]

LGTM! Confirmed that the updated config packages can be installed and are functional downstream. IMO any further fixes that may or may not be needed can be handled in separate PRs.