CodeQL actions/missing-workflow-permissions: auto-approve.yml, auto-merge.yml, lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
Carries the browser environment fixes: JSDOM's WebSocket and the location
global, which an ApiPromise against a live node needs in a browser-env spec.
Also the build import check that accepts every node: builtin. dev depends on
^0.86.8 of the other two.
The browser environment copied window, document, navigator and localStorage
onto the global, but not location. Code that reads the bare global, such as
the apps URL type decoder, threw "location is not defined" while an
ApiPromise was being created, so the api never became ready. location is now
exposed with the other window objects.
The browser environment replaces Node's Event with JSDOM's. Node's WebSocket
dispatches through Node's EventTarget, which rejects that Event, so no open,
message or error reached a listener and no connection ever came up: an
ApiPromise against a live node never became ready. JSDOM's WebSocket now
replaces Node's, as Event and CustomEvent already do. A spec completes a
handshake with a local server and receives a frame.
The import check allowed twelve hand-listed node: modules and reported any other
builtin, node:http among them, as missing from package.json dependencies. A
builtin is never a dependency; the list now comes from node:module.
- toBeNull and not.toBeNull took a parameter named value, which shadowed
the value under test: .toBeNull() always failed and .not.toBeNull()
always passed.
- not.toHaveLength and toHaveProperty (dotted or array path, optional
expected value with asymmetric matchers) were unimplemented stubs.
- toThrow and rejects.toThrow with a string required the message to be
equal; as in jest, the message now has to contain it. A RegExp matches
the message and an Error compares messages.
react-tooltip, on hover, called getComputedStyle, MutationObserver and
ResizeObserver, none of which the browser env exposed. The env now
also carries the UI event constructors (MouseEvent, KeyboardEvent,
FocusEvent and the rest), DOMRect, MutationObserver and a bound
getComputedStyle from JSDOM, grouped by kind.
JSDOM has no ResizeObserver. It does no layout either, so no element
ever changes size; the env's ResizeObserver accepts observe() and never
calls back, which is what a real one would do on a page that never
resizes.
The browser env exposed the HTML*Element constructors but not the
classes above them, so a library checking `instanceof Element` (as
react-tooltip does on every hover) threw "Element is not defined".
Node, Element, Document, DocumentFragment, Text, ShadowRoot and
SVGElement now come from JSDOM.
expect().toContain and .not.toContain were stubs. A string contains a
substring; any other iterable contains the item itself, not a
deep-equal copy, as in jest.
Globals were only set where Node had none, and Node defines Event and
CustomEvent itself. Code running in the browser env therefore built
Node events, which a JSDOM node refuses: react-tooltip's
window.dispatchEvent(new CustomEvent(...)) threw "parameter 1 is not of
type 'Event'". In the browser env these two now come from JSDOM, as they
do under jest-environment-jsdom.
Specs that replace a module need mock.module from node:test, which
Node only exposes behind this flag. The runner rejected unknown flags,
so there was no way to turn it on. It is now accepted and forwarded to
node like --import and --require.
The repo's own test run enables it, and a spec checks that a module
registered as a mock is what a later dynamic import receives.
.toEqual compared with assert.deepEqual and never looked at matchers, so
expect(x).toEqual(expect.arrayContaining(...)) or
.toEqual(expect.stringContaining(...)) always failed; matchers only
worked inside toHaveBeenCalledWith. arrayContaining was also typed to
take a string and checked value.includes(theWholeArray).
.toEqual (and .not.toEqual) now apply matchers wherever they appear in
the expected value, with the previous deepEqual unchanged when there
are none; arrayContaining asserts that every expected entry equals (or
matches) one of the array's entries. Seven new cases; with the old
.toEqual six of them fail.
braces 3.0.3, the latest upstream release, has an open advisory with no
fixed version (CVE-2026-93687: deeply nested patterns exhaust the stack
in its recursive AST walkers). @pezkuwi/braces is a fork that rejects
nesting deeper than maxDepth (500) with a SyntaxError; its tests include
the upstream suite.
All 56 open Dependabot alerts matched versions the lockfile still held
after the eslint 10 move: tar, fast-uri, brace-expansion, minimatch,
ip-address, picomatch, ws, browserslist and others, each with a fixed
version inside the range its dependents ask for. `yarn up -R` moves
them there; terser-webpack-plugin 5.6 also drops serialize-javascript.
Left open: braces 3.0.3, for which no fixed version exists.
Carries the run-lint type check over the referenced projects, the
`export *` fix moved into a suggestion, and whole-line removal of unused
disable directives. dev depends on ^0.86.4 of the other two.
eslint core replaces an unused directive comment with a single space,
so --fix left a blank line wherever the comment sat on a line of its
own. A processor now widens that fix: the whole line when the comment
is alone on it, otherwise the comment and the space beside it. Fixes
with a rule id, and the removal of one rule name out of several, are
unchanged.
`export *` loads the module; `export type *` is erased. The autofix
rewrote one into the other whenever a module exported only types, so a
module that registers something when loaded stopped being loaded (the
api typegen lost its Handlebars partial this way).
The report stays an error; the rewrite is now a suggestion, which --fix
does not apply. Named re-exports are unaffected: under
verbatimModuleSyntax their type-only form is already a compile error.
The root tsconfig.build.json has `files: []` and only references the
packages, so `tsc --noEmit --project tsconfig.build.json` checked no file:
a type error added to a package source passed lint with exit code 0.
--build follows the references. It cannot be combined with --noEmit
(TS6310), so it writes the declarations the build writes; previous build
output is removed first, since package configs without an `include` pick
it up as source. Measured on the consumers: no new errors, 1-47 s.
typescript-eslint 8 reports `x as T` as unnecessary when the receiver
would accept `x` unchanged, and its autofix deletes the assertion. That
is unsound when the assertion also drives inference around it:
const { validators } = found || { validators: {} as ValPoints };
loses the type of `validators`, and every later use becomes an
unresolved type (api-derive's stakerRewards after an autofix). It also
deletes assertions kept on purpose for another environment's typings.
Across api, common, ui and apps it raised 45 reports.
The plugin is now registered through withoutContextualAssertions, which
drops only that report on `as` / `<T>` assertions. Assertions to the
type an expression already has are still reported and fixed, and so
are non-null assertions a receiver makes unnecessary. A spec lints a
fixture through the real type checker with the plugin wrapped and as
published, so it fails if the filter stops filtering.
A repository's own eslint config turns rules on and off by name, and a
renamed rule there is the same trap as in a disable comment: measured on
pezkuwi-extension, 'import/extensions': 'off' and, for specs,
'deprecation/deprecation': 'off' silently stopped applying, which surfaced
17 import-x/extensions and 57 deprecation findings the repository had
deliberately turned off.
The tool now renames rule keys (quoted or not) in eslint.config.{js,mjs,cjs,
ts,mts,cts}; other keys are left alone. A rule that became several
(@typescript-eslint/ban-types) needs its value repeated for each, so it is
reported for a hand edit and the tool exits 1.
Moving a repository to 0.86 renames rules (formatting rules to @stylistic,
import/* to import-x/*, deprecation/deprecation to
@typescript-eslint/no-deprecated, and typescript-eslint 8's removals). A
disable comment that still names the old rule disables nothing: eslint
reports it unused, --fix deletes it, and the rule it held back applies.
Measured on pezkuwi-apps: the generated typesBundle.ts carries
/* eslint-disable quotes */, and without a rename --fix rewrote all 188k
lines of it.
pezkuwi-dev-migrate-eslint10 renames the rules in eslint-disable /
eslint-enable comments across the tracked files, before the first lint on
0.86, including such comments inside string literals, which is how
generators emit them. Core renames come from eslint's own rule metadata
(meta.deprecated.replacedBy); the rest are the mappings of #9. --check
reports without writing and exits 1 when there is work.
Run on this repository it found one: pezkuwi-dev-deno-map writes
/* eslint-disable import/extensions */ into the Deno mod.ts it generates.
The spec runs the tool in a scratch git repository: every kind of rename,
descriptions kept, duplicates merged, a directive inside a string, current
names and bare disables left alone, and --check. Its fixture is spelt so
the tool, run here, cannot rewrite it.
A minor version for the eslint 10 / typescript-eslint 8 toolchain (#9):
repositories that move to it get new rules from the eslint, typescript-eslint
and react-hooks presets, so it should not arrive through a ^0.85 range. dev
depends on ^0.86.0 of the other two.
eslint 8 and typescript-eslint 6 are past their support, and the webpack
dev server chain carried the dependency alerts every repository using this
package inherited. Upstream @polkadot/dev still pins the same versions, so
this leaves it on purpose.
The rules are carried over with their options, so the lint means what it
meant:
- eslint-config-standard 17 (written for eslint 8) is replaced by its 161
rules in config/eslint.standard.js, with their options. Its 48 formatting
rules, deprecated in eslint core, are the same rules in @stylistic;
no-new-object and no-new-symbol are no-object-constructor and
no-new-native-nonconstructor; import/* is import-x/*.
- eslint-plugin-import (eslint <= 9) is eslint-plugin-import-x;
eslint-plugin-deprecation is @typescript-eslint/no-deprecated; the
formatting rules of core, typescript-eslint and eslint-plugin-react used
in eslint.rules.js are their @stylistic versions with the same options.
- typescript-eslint 8's preset swaps core no-unused-expressions for its own
with default options; standard's (short circuit, ternary and tagged
templates allowed) are carried over to it.
- eslint-plugin-react and eslint-plugin-header still call context methods
eslint 10 removed; @eslint/compat's fixupPluginRules supplies them. The
header rule also gets `schema: false`, as eslint 9+ rejects options for a
rule with no schema. The original header plugin stays rather than its
fork: it reports at the first token after leading comments, so a
generated file's /* eslint-disable */ still covers it, as it always has.
The effective config was compared rule by rule (--print-config) for .ts,
.tsx, .spec.ts and .mjs files before and after. Every rule that left has
its successor active; option differences are eslint 10 spelling out
defaults. New rules come from the eslint 10, typescript-eslint 8 and
react-hooks 7 presets. no-inner-declarations left eslint's preset upstream.
Also current: webpack-dev-server 6, webpack-cli 7, webpack-merge 6, rollup
plugins, madge 8, gh-release 8, globals 17, espree 11; Node >= 20.19 for
the dev package, which eslint 10 requires.
In this repository the new rules found: Function types now named by
no-unsafe-function-type; optional chains, includes() and RegExp#exec where
they say the same thing; createWrapper returns Describe, so its three casts
were redundant; rootCjs.spec casts through unknown, so the lint result does
not depend on whether build/ exists. lint, build and test (149 passed) pass,
and lint leaves the tree unchanged with and without a build.
Nothing proposes updates to the workflow actions: several still declare
the Node 20 runtime, which runners already force to Node 24 with a warning
on every run. Dependabot now checks them monthly and groups all action
updates into one pull request.
npm holds dev-test and dev-ts at 0.85.7 while this tree said 0.85.4 (the
published files match main's sources; the versions were bumped only where
they were published). All three move to 0.85.12, as upstream releases them
in step, and dev depends on ^0.85.12 of the other two, so the CJS import()
fix reaches all of them.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
continue-on-error came with the upstream template: lint, test and build had
been red here since January while every pull request read as passing.
fail-fast: false keeps each step running to the end when another fails.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The CJS build transpiled with module CommonJS and NodeNext resolution. On
TypeScript 5.5 that kept import() of an ES module; from 5.6 it becomes
require(), which an ES module cannot answer on Node before 22. CJS is now
emitted with module NodeNext, under which TypeScript must keep import() for
an ES module. Across this repository's output the only change is that line,
plus a strict-mode header on one file with no imports.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@tsconfig/strictest dropped checkJs in 2.0.8, so every .js and .mjs file
fell out of the program: lint could not parse them with type information,
and JavaScript in every repository built with this config went unchecked.
allowJs and checkJs are now set here, independent of the base.
Two @ts-expect-error lines in config/eslint.js no longer had an error to
expect: eslint-plugin-import 2.32 and eslint-plugin-react 7.37 ship types.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With the manifests broken, b65f265 and 4539abb worked around the symptoms:
rootJs imported itself by relative path instead of as @pezkuwi/dev, a
hand-written dynamic.d.mts stood in for the .mjs, and suite.spec.ts declared
its own describe/it/expect and imported a .d.ts at run time, which failed
the file. All three are reverted to upstream's form.
The import-attribute check now expects `with`: Node 22 removed `assert`.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Commit cb6801a replaced packages/{dev,dev-test,dev-ts}/package.json with the
build's rewritten copies: exports pointing at ./index.d.ts, ./cjs/* and
other files that exist only under build/, and main/module/types to match.
In the workspace that made @pezkuwi/dev-test/globals.d.ts unresolvable, so
tsc failed on every describe/it/expect (build and test red since January),
and packages/dev lost its devDependencies.
The four fields are back to the source form (identical to upstream's),
packages/dev's devDependencies are restored with React aligned to dev-test's
19, dev-test's @types/jsdom returns, and the generated globals.d.cts that was
committed beside the sources is removed. packageInfo follows the version.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
build-ts split repository.url on 'https://github.com/'. Since the April
move of repository URLs to git.pezkuwichain.io that split returns
undefined and the build stops with "Cannot read properties of undefined
(reading 'split')" in every repo on the new host (pezkuwi-wasm, and this
one). Where it did not throw, orderPackageJson rebuilt bugs, homepage and
repository.url as github.com, silently reverting the declared host in
every package it built.
repoBaseFromUrl now parses the declared URL (accepting a git+ prefix and
a trailing .git) and the published metadata is derived from it.
Checked end to end on pezkuwi-wasm: the build completes and leaves every
package.json unchanged; the built package keeps its git.pezkuwichain.io
repository URL.
- Build script was adding ./cjs/ prefix even when main already had it
- Fixed @testing-library/react dependency for tests
- Changed package-style imports to relative imports in rootJs/index.ts
- Bump version to 0.85.5
When package.json already has main: './cjs/index.js', the build script
was incorrectly adding another ./cjs/ prefix resulting in './cjs/cjs/index.js'
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add explicit Describe and It interfaces with todo support
- Fix mock type compatibility in jest.ts
- Update import assertions to import attributes (assert -> with)
- Add dynamic.d.mts declaration file
- Fix spec files to use explicit type declarations
- Updated all copyright headers from 2025 to 2026 (system date shows 2026)
- Added build output files to eslint ignore list in packages/dev/config/eslint.js
- Added build output patterns to .gitignore
- Ignored: packages/*/*.{d.ts,js,mjs,cjs}, packages/*/cjs/**, packages/*/env/**,
packages/*/rootJs/**, packages/*/rootStatic/**
- Successfully resolved 521 lint errors by properly ignoring generated files
- Build outputs should not be linted (source files are linted instead)
- Lint and build now pass successfully
