Skip to content

feat(PLATENG-897): Upgrade eslint-config to 4.0.0 with native flat config#49

Merged
ryanmcafee merged 6 commits intomainfrom
feat/PLATENG-897-update-jupiterone-typescript-tools-to-use-jupiterone-eslint-c
Feb 12, 2026
Merged

feat(PLATENG-897): Upgrade eslint-config to 4.0.0 with native flat config#49
ryanmcafee merged 6 commits intomainfrom
feat/PLATENG-897-update-jupiterone-typescript-tools-to-use-jupiterone-eslint-c

Conversation

@ryanmcafee
Copy link
Contributor

@ryanmcafee ryanmcafee commented Feb 10, 2026

Summary

Implements PLATENG-897

Update @jupiterone/typescript-tools to use @jupiterone/eslint-config@4.0.0 which provides native ESLint 9 flat config support, eliminating the need for the FlatCompat bridge and removing the @eslint/eslintrc dependency.

Changes

  • Upgrade @jupiterone/eslint-config from ^3.0.0 to ^4.0.0
  • Remove @eslint/eslintrc dependency (no longer needed)
  • Rewrite eslint.config.mjs to use createConfig() from @jupiterone/eslint-config/flat instead of FlatCompat bridge
  • Fix unsafe type patterns (catch blocks, JSON.parse returns) to comply with recommendedTypeChecked rules now enabled by the new config
  • Make readJsonFileForCli generic for type-safe JSON parsing
  • Deduplicate readJsonFile in check-tsconfig.ts — now uses shared readJsonFileForCli from src/
  • Consolidate duplicate PackageManifest and PackageInfo types in check-tsconfig.ts — now imports from src/types.ts
  • Rename packageObj to packageManifest in check-tsconfig.ts to align with shared type
  • Enable useUnknownInCatchVariables: true in base tsconfig, removing redundant explicit : unknown catch annotations project-wide

Why

Consumer projects currently get vulnerable eslint@8.x installed due to sub-dependencies from eslint-config@3.0.0 which relied on older @typescript-eslint/*@6.x packages. This upgrade eliminates those transitive dependencies.

Validation Results

  • Build: PASS
  • TypeCheck: PASS
  • Lint: PASS
  • Tests: N/A (no test suite in this project)

Test Plan

  • Verify npm run build passes
  • Verify tsc --noEmit passes
  • Verify npm run lint passes
  • Verify consumer projects no longer get vulnerable eslint@8.x installed
  • Verify npm audit shows 0 vulnerabilities in consumer projects

…nfig

Migrate from FlatCompat bridge to native ESLint 9 flat config API
provided by @jupiterone/eslint-config@4.0.0. Remove @eslint/eslintrc
dependency. Fix unsafe type patterns flagged by stricter type-checked
lint rules.

Implements PLATENG-897
@socket-security
Copy link

socket-security bot commented Feb 10, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​typescript-eslint/​parser@​8.53.0 ⏵ 8.55.01001007198100
Updated@​jupiterone/​eslint-config@​3.0.0 ⏵ 4.0.075 +7100100 +1386 +11100
Updated@​typescript-eslint/​eslint-plugin@​8.53.0 ⏵ 8.55.09910080 +198100

View full report

import.meta.dirname is only available in Node 20.11+/21.2+.
The CI runs on Node 18.x where it is undefined, causing ESLint
to fail with "tsconfigRootDir is required". Fall back to
dirname(fileURLToPath(import.meta.url)) when import.meta.dirname
is not available.
Remove duplicate readJsonFile function and type definitions from
check-tsconfig.ts in favor of shared readJsonFileForCli and types
from src/. Enable useUnknownInCatchVariables in the base tsconfig
so the compiler enforces unknown catch variables project-wide,
removing the need for explicit `: unknown` annotations.
@ryanmcafee ryanmcafee requested a review from a team February 11, 2026 21:24
@ryanmcafee ryanmcafee enabled auto-merge February 11, 2026 23:07
@ryanmcafee ryanmcafee merged commit 66539ca into main Feb 12, 2026
9 checks passed
@ryanmcafee ryanmcafee deleted the feat/PLATENG-897-update-jupiterone-typescript-tools-to-use-jupiterone-eslint-c branch February 12, 2026 17:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants