Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

upgrade eslint, eslint-plugin-n, eslint-config-standard (VULN-5530) #4032

Closed
wants to merge 10 commits into from

Conversation

tlhunter
Copy link
Member

@tlhunter tlhunter commented Feb 6, 2024

What does this PR do?

  • drops eslint-plugin-node and depends entirely on eslint-plugin-n
  • upgrades eslint

Motivation

  • original eslint-plugin-node is unmaintained
  • quiets automated vuln scanners

Copy link

github-actions bot commented Feb 6, 2024

Overall package size

Self size: 5.99 MB
Deduped: 61.58 MB
No deduping: 62.34 MB

Dependency sizes

name version self size total size
@datadog/native-iast-taint-tracking 1.6.4 16.43 MB 16.44 MB
@datadog/native-appsec 7.0.0 14.51 MB 14.52 MB
@datadog/pprof 5.0.0 9.59 MB 10.44 MB
protobufjs 7.2.5 2.77 MB 6.56 MB
@datadog/native-iast-rewriter 2.2.3 2.19 MB 2.28 MB
@opentelemetry/core 1.14.0 872.87 kB 1.47 MB
@datadog/native-metrics 2.0.0 898.77 kB 1.3 MB
@opentelemetry/api 1.4.1 780.32 kB 780.32 kB
import-in-the-middle 1.7.3 67.62 kB 731.01 kB
pprof-format 2.0.7 588.12 kB 588.12 kB
msgpack-lite 0.1.26 201.16 kB 281.59 kB
opentracing 0.14.7 194.81 kB 194.81 kB
semver 7.5.4 93.4 kB 123.8 kB
@datadog/sketches-js 2.1.0 109.9 kB 109.9 kB
lodash.sortby 4.7.0 75.76 kB 75.76 kB
lru-cache 7.14.0 74.95 kB 74.95 kB
ipaddr.js 2.1.0 60.23 kB 60.23 kB
ignore 5.2.4 51.22 kB 51.22 kB
int64-buffer 0.1.10 49.18 kB 49.18 kB
shell-quote 1.8.1 44.96 kB 44.96 kB
istanbul-lib-coverage 3.2.0 29.34 kB 29.34 kB
tlhunter-sorted-set 0.1.0 24.94 kB 24.94 kB
limiter 1.1.5 23.17 kB 23.17 kB
dc-polyfill 0.1.4 23.1 kB 23.1 kB
retry 0.13.1 18.85 kB 18.85 kB
node-abort-controller 3.1.1 16.89 kB 16.89 kB
jest-docblock 29.7.0 8.99 kB 12.76 kB
crypto-randomuuid 1.0.0 11.18 kB 11.18 kB
path-to-regexp 0.1.7 6.78 kB 6.78 kB
koalas 1.0.2 6.47 kB 6.47 kB
methods 1.1.2 5.29 kB 5.29 kB
module-details-from-path 1.0.3 4.47 kB 4.47 kB

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@pr-commenter
Copy link

pr-commenter bot commented Feb 6, 2024

Benchmarks

Benchmark execution time: 2024-02-07 18:16:12

Comparing candidate commit 57c2f6c in PR branch tlhunter/replace-eslint-plugin-node with baseline commit 1924212 in branch master.

Found 2 performance improvements and 0 performance regressions! Performance is the same for 260 metrics, 4 unstable metrics.

scenario:plugin-graphql-with-depth-off-18

  • 🟩 max_rss_usage [-125.310MB; -124.190MB] or [-13.021%; -12.905%]

scenario:plugin-graphql-with-depth-on-max-18

  • 🟩 max_rss_usage [-134.821MB; -107.215MB] or [-14.115%; -11.225%]

Copy link

codecov bot commented Feb 6, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (1924212) 85.15% compared to head (57c2f6c) 85.15%.
Report is 4 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #4032   +/-   ##
=======================================
  Coverage   85.15%   85.15%           
=======================================
  Files         243      243           
  Lines       10504    10504           
  Branches       33       33           
=======================================
  Hits         8945     8945           
  Misses       1559     1559           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@tlhunter tlhunter marked this pull request as ready for review February 7, 2024 18:11
@tlhunter tlhunter requested review from a team as code owners February 7, 2024 18:11
@tlhunter tlhunter enabled auto-merge (squash) February 7, 2024 18:19
@tlhunter tlhunter changed the title VULN-5530: replace eslint-plugin-node w/ eslint-plugin-n upgrade eslint, eslint-plugin-n, eslint-config-standard (VULN-5530) Feb 7, 2024
@tlhunter tlhunter disabled auto-merge February 7, 2024 18:35
@tlhunter tlhunter enabled auto-merge (squash) February 7, 2024 18:35
@@ -1,4 +1,5 @@
const http = require('http')
// eslint-disable-next-line import/no-absolute-path
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we allow this, why not add it as a global rule?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's some junk for a test that we otherwise wouldn't want i real tracer code

@@ -3,4 +3,5 @@ require('dd-trace').init({
service: 'dd-trace-bad-init'
})

// eslint-disable-next-line import/no-extraneous-dependencies
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similarly, if this is allowed in the project, why not add it as a global rule?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's some junk for a test that we otherwise wouldn't want i real tracer code

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could always add a .eslintrc override at the root folder of the tests.

"eslint-plugin-import": "^2.8.0",
"eslint-plugin-mocha": "^10.1.0",
"eslint-plugin-n": "^15.7.0",
"eslint-plugin-node": "^5.2.1",
"eslint-plugin-n": "^16.6.2",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This version doesn't support older versions of Node. Security fixes should be backportable to all release lines.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm... Do we run the linter with every supported version of Node?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In some cases yes.

@@ -54,6 +54,7 @@ class SpanProcessor {
}

if (this._killAll) {
// eslint-disable-next-line array-callback-return
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it a .map then? Similar question for all other occurrences.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like the author intended to use a forEach?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Then I'd say to change the code instead of adding an eslint rule.

@juan-fernandez juan-fernandez requested review from juan-fernandez and removed request for tonyredondo February 8, 2024 14:12
@juan-fernandez
Copy link
Collaborator

do we still want to do this? @tlhunter

@Qard Qard closed this Mar 22, 2024
auto-merge was automatically disabled March 22, 2024 14:29

Pull request was closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants