build(deps-dev): bump @duckduckgo/eslint-config from v0.1.0 to v0.2.1#2718
build(deps-dev): bump @duckduckgo/eslint-config from v0.1.0 to v0.2.1#2718dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@duckduckgo/eslint-config](https://github.com/duckduckgo/eslint-config) from v0.1.0 to v0.2.1. - [Release notes](https://github.com/duckduckgo/eslint-config/releases) - [Changelog](https://github.com/duckduckgo/eslint-config/blob/main/CHANGELOG.md) - [Commits](duckduckgo/eslint-config@09f3780...1a2a3f0) --- updated-dependencies: - dependency-name: "@duckduckgo/eslint-config" dependency-version: 1a2a3f071f76b51a9917df6476211a8f20eb81bd dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Suggested comment for Cursor review (copy and paste as a new comment): Note: GitHub Actions bot cannot trigger Cursor agent directly. Please copy the above comment to invoke the review. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency risk review for @duckduckgo/eslint-config v0.1.0 -> v0.2.1:
Confirmed findings: none blocking.
Evidence checked:
- PR diff only updates
package.jsonandpackage-lock.jsonfor this direct dev dependency. - Upstream
index.jsis unchanged between the old resolved commit09f3780...and v0.2.11a2a3f...; upstream release notes are release/dependabot automation, README/changelog, and dependency metadata changes. - The lockfile impact is limited to dev-only lint packages:
eslint-config-prettier9.1.2 -> 10.1.8,eslint-plugin-n17.23.2 -> 18.0.1, plus related resolver/semver/get-tsconfig/tapable changes.ts-declaration-locationis removed becauseeslint-plugin-nmoved it to an optional peer. - Current repo usage still needs the dependency:
eslint.config.jsimports@duckduckgo/eslint-configdirectly. - Local validation passed with the PR state after generated assets were built:
npm run build && npm run lint. - PR unit/integration/snapshot checks observed passing for the dependency-relevant paths. The failed
buildjob is a release-branch push rejection, and the failed Asana sync is missingASANA_ACCESS_TOKEN; neither appears caused by this dependency bump.
Uncertain/residual concerns:
eslint-plugin-n18 is a breaking major and the installed package declares Node^20.19.0 || ^22.13.0 || >=24. CI uses.nvmrcvalue22and resolved locally to Node 22.22.3, so validation passed. If any supported developer/automation environment pins an older Node 22 point release, lint/install could fail and should be validated there.npm auditreports existing repo dev-dependency advisories, but the vulnerable package versions are unchanged between base and this PR; I did not find a new advisory introduced by this bump.
No separate fix PR drafted because I did not find a concrete dependency-update issue to fix.
Sent by Cursor Automation: Review dependabot
There was a problem hiding this comment.
Web Compatibility Assessment
No findings. This PR only updates the root dev dependency @duckduckgo/eslint-config and the corresponding lockfile entries; it does not change injected runtime code, wrapper utilities, message bridge, platform entry points, DOM manipulation, or API shims.
Security Assessment
No findings. There are no changes to captured globals, messaging transports, origin validation, config handling, iframe access, or page-world execution paths.
Risk Level
Low Risk: devDependency/lockfile-only change affecting lint tooling rather than shipped injected JavaScript behavior.
Recommendations
No code changes requested. Verification performed: npm ci, npm run build, and npm run lint all pass. The release comparison for @duckduckgo/eslint-config v0.1.0...v0.2.1 shows automation/metadata changes and dependency metadata updates, with no index.js rule/config changes.
Sent by Cursor Automation: Web compat and sec
1 participant
Bumps @duckduckgo/eslint-config from v0.1.0 to v0.2.1.
Release notes
Sourced from @duckduckgo/eslint-config's releases.
Changelog
Sourced from @duckduckgo/eslint-config's changelog.
Commits
1a2a3f0Bump version to: 0.2.1 [skip ci]e2b7298Update CHANGELOG.md [skip ci]d773502don't apply major label to dependabot prs9bc1a41Bump version to: 0.2.0 [skip ci]5d03d08Update CHANGELOG.md [skip ci]7ddf7cfset release CI identity to Dax07b1e4cMerge pull request #4 from duckduckgo/max/automation3d05557don't hardcode the version in readme930248cuse colldown from dependabot673dccfMerge pull request #3 from duckduckgo/max/dependabotDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Dev-only dependency bump with no runtime or source changes; main risk is CI lint behavior shifting if the upgraded shared config or plugins enforce new rules.
Overview
Bumps the shared
@duckduckgo/eslint-configdev dependency from v0.1.0 to v0.2.1 inpackage.jsonand refreshespackage-lock.jsonaccordingly.The lockfile also picks up updated transitive lint tooling from that package—notably
eslint-config-prettierv10,eslint-plugin-nv18 (tighter Node engine requirements and optional TypeScript-related peers), and related semver/tapable bumps. No application or ESLint config source files change in this diff; only dependency pins.Reviewed by Cursor Bugbot for commit bfd5ad8. Bugbot is set up for automated code reviews on this repo. Configure here.