Bump the wonder-stuff group with 2 updates#3343
Conversation
dependabot
bot
added
dependencies
🗄️ Schema Change: No Changes ✅ |
🛠️ Item Splitting: No Changes ✅ |
|
Size Change: 0 B Total Size: 486 kB ℹ️ View Unchanged
|
npm Snapshot: PublishedGood news!! We've packaged up the latest commit from this PR (bc5fb4c) and published it to npm. You Example: pnpm add @khanacademy/perseus@PR3343If you are working in Khan Academy's frontend, you can run the below command. ./dev/tools/bump_perseus_version.ts -t PR3343If you are working in Khan Academy's webapp, you can run the below command. ./dev/tools/bump_perseus_version.js -t PR3343 |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| "@khanacademy/eslint-config": "^6.0.2", | ||
| "@khanacademy/eslint-plugin": "^3.2.2", |
There was a problem hiding this comment.
🔴 Bumping @khanacademy/eslint-config from v5 to v6 introduces several unmet peer dependency requirements that could cause linting failures. Most critically, the new config requires eslint-import-resolver-typescript@^4.4.4 but the project has ^3.5.5 (major version mismatch); it also requires eslint-plugin-import@^2.32.0 (project has 2.29.1) and @typescript-eslint/*@8.46.3 (project has 8.27.0). These peer deps should be bumped alongside the eslint-config upgrade.
Extended reasoning...
What the bug is
@khanacademy/eslint-config@6.0.2 declares several peer dependencies that are not satisfied by the versions currently in this project's package.json. The lockfile at lines 2280-2287 shows the peer dependency requirements explicitly:
eslint-import-resolver-typescript: ^4.4.4— project has^3.5.5(resolves to 3.6.1)eslint-plugin-import: ^2.32.0— project has^2.29.1(resolves to 2.29.1)@typescript-eslint/eslint-plugin: 8.46.3(exact) — project has^8.18.0(resolves to 8.27.0)@typescript-eslint/parser: 8.46.3(exact) — project has^8.18.0(resolves to 8.27.0)
The most severe mismatch
The eslint-import-resolver-typescript mismatch is the most concerning because it crosses a major version boundary (v3 vs v4 required). Major version bumps typically indicate breaking API changes. If the eslint-config v6 relies on v4-specific resolver APIs, import resolution during linting could fail or behave incorrectly.
Step-by-step proof
- The PR changes
package.jsonline 19 from"@khanacademy/eslint-config": "^5.2.1"to"^6.0.2". - In
pnpm-lock.yamlat line 2286, the resolved@khanacademy/eslint-config@6.0.2declareseslint-import-resolver-typescript: ^4.4.4as a peer dependency. package.jsonline 65 still has"eslint-import-resolver-typescript": "^3.5.5".- The lockfile at line 11090 confirms pnpm resolved the config with
eslint-import-resolver-typescript: 3.6.1— violating the^4.4.4peer dep requirement. - Similarly, line 2287 requires
eslint-plugin-import: ^2.32.0, but line 11091 shows2.29.1was resolved. - Lines 2282-2283 require exact versions
@typescript-eslint/eslint-plugin: 8.46.3and@typescript-eslint/parser: 8.46.3, but lines 11086-11087 show8.27.0was resolved.
Why this wasn't caught
pnpm defaults to strict-peer-dependencies=false, so it installs successfully with warnings rather than erroring. Dependabot only bumped the direct dependencies (eslint-config and eslint-plugin) without analyzing or updating their peer dependency requirements.
Impact and fix
The peer dependency violations could cause linting failures, especially from the major version mismatch in eslint-import-resolver-typescript. The eslint-plugin-import and @typescript-eslint/* mismatches are within the same major version so are less likely to cause breakage, but still represent unmet contracts. The fix is to bump all four peer dependencies in package.json to versions that satisfy the requirements: eslint-import-resolver-typescript to ^4.4.4, eslint-plugin-import to ^2.32.0, and both @typescript-eslint packages to ^8.46.3.
Note: One verifier suggested the @typescript-eslint mismatch is a duplicate of the resolver mismatch since they share the same root cause. While the root cause is indeed the same (Dependabot not updating peer deps), these are distinct packages with different version gaps and risk profiles, and the fix requires updating each one separately. Consolidating them here ensures nothing is missed.
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/wonder-stuff-85f70cbe43
branch
from
689c58d to
49661fd
Compare
Bumps the wonder-stuff group with 2 updates: [@khanacademy/eslint-config](https://github.com/Khan/wonder-stuff/tree/HEAD/packages/eslint-config-khan) and [@khanacademy/eslint-plugin](https://github.com/Khan/wonder-stuff/tree/HEAD/packages/eslint-plugin-khan). Updates `@khanacademy/eslint-config` from 5.2.1 to 6.0.2 - [Release notes](https://github.com/Khan/wonder-stuff/releases) - [Changelog](https://github.com/Khan/wonder-stuff/blob/main/packages/eslint-config-khan/CHANGELOG.md) - [Commits](https://github.com/Khan/wonder-stuff/commits/@khanacademy/eslint-config@6.0.2/packages/eslint-config-khan) Updates `@khanacademy/eslint-plugin` from 3.1.2 to 3.2.2 - [Release notes](https://github.com/Khan/wonder-stuff/releases) - [Changelog](https://github.com/Khan/wonder-stuff/blob/main/packages/eslint-plugin-khan/CHANGELOG.md) - [Commits](https://github.com/Khan/wonder-stuff/commits/@khanacademy/eslint-plugin@3.2.2/packages/eslint-plugin-khan) --- updated-dependencies: - dependency-name: "@khanacademy/eslint-config" dependency-version: 6.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: wonder-stuff - dependency-name: "@khanacademy/eslint-plugin" dependency-version: 3.2.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: wonder-stuff ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/wonder-stuff-85f70cbe43
branch
from
49661fd to
bc5fb4c
Compare
Bumps the wonder-stuff group with 2 updates: @khanacademy/eslint-config and @khanacademy/eslint-plugin.
Updates
@khanacademy/eslint-configfrom 5.2.1 to 6.0.2Release notes
Sourced from
@khanacademy/eslint-config's releases.Changelog
Sourced from
@khanacademy/eslint-config's changelog.Commits
Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for
@khanacademy/eslint-configsince your current version.Updates
@khanacademy/eslint-pluginfrom 3.1.2 to 3.2.2Release notes
Sourced from
@khanacademy/eslint-plugin's releases.Changelog
Sourced from
@khanacademy/eslint-plugin's changelog.Commits
Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for
@khanacademy/eslint-pluginsince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions