Skip to content
This repository was archived by the owner on Feb 13, 2025. It is now read-only.

Update dependency standard to v11 #2

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

mend-for-github-com[bot]
Copy link

This PR contains the following updates:

Package Type Update Change
standard (source) devDependencies major ^4.5.4 -> ^11.0.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score CVE
High High 9.1 CVE-2019-10744
High High 7.5 CVE-2020-7792
High High 7.5 CVE-2016-10540
High High 7.4 CVE-2020-8203
High High 7.2 CVE-2021-23337
High High 7.1 WS-2018-0590
Medium Medium 6.5 CVE-2019-1010266
Medium Medium 6.5 CVE-2018-3721
Medium Medium 5.6 CVE-2018-16487
Medium Medium 5.3 WS-2018-0347
Medium Medium 5.3 CVE-2017-16137

Release Notes

standard/standard

v11.0.0

Compare Source

This release has no new rules, but it does update to the latest version of eslint,
version 4, which has some significant changes to existing rules. Most updates make
the indentation rules more strict.

Thankfully, most users will just need to run standard --fix to update code to be
compliant.

New features
  • Update eslint from ~3.19.0 to ~4.18.0.

    • The indent rule is more strict.
    • The padded-blocks rule is more strict.
    • The space-before-function-paren rule is more strict.
    • The no-multi-spaces rule is more strict.
    • Minor improvements to:
      • no-extra-parens,
      • no-unexpected-multiline,
      • no-regex-spaces, and
      • space-unary-ops
  • Update eslint-plugin-import from ~2.2.0 to ~2.8.0

    • Updated for eslint 4.0 compatibility.
    • Various small bug fixes included related to import/* rules.
  • Update eslint-plugin-node from ~4.2.2 to ~6.0.0

    • The no-deprecated-api rule is updated with Node.js 8 support and improved
      Node 6 support.
  • Upodate eslint-plugin-promise from ~3.5.0 to ~3.6.0.

  • Update eslint-plugin-react from ~6.10.0 to ~7.6.1

    • Fix jsx-indent crash
    • Fix jsx-indent indentation calculation with nested JSX.
    • Fix jsx-no-undef will not check the global scope by default.
    • Fix jsx-curly-spacing newline with object literals bug.
    • Fix jsx-curly-spacing schema incompatibility with ESLint 4.2.0.
    • Fix alignment bug in jsx-indent.
Changed rules
  • Relax rule: Don't mark Rails Asset Pipeline comments (comments that start with //=)
    as errors. (spaced-comment) #​918

👏 Huge thanks to @​Flet for putting together most of this
release!

v10.0.3

Compare Source

  • Internal changes (incremented dependency versions)

v10.0.2

Compare Source

Changed rules
  • Relax rule: Disallow import of modules using absolute paths (import/no-absolute-path) #​861
    • This rule was responsible for up to 25% of the running time of standard, so we are disabling it until its performance improves.

v10.0.1

Compare Source

  • Internal changes (incremented dependency versions)

v10.0.0

Compare Source

standard just turned 10.0.0! 🎉

As with every new major release, there are lots of new rules in 10.0.0 designed to
help catch bugs and make programmer intent more explicit.

standard is more popular than ever – 330,000 downloads per month! It's even
more popular – 670,000 downloads per month – if you include the
shareable ESLint config
that we also publish.

The most important change in 10.0.0 is that using deprecated Node.js APIs is now
considered an error
. It's finally time to update those dusty old APIs!

Deprecated APIs are problematic because they may print warning messages in the
console in recent versions of Node.js. This often confuses users and leads to
unnecessary support tickets for project maintainers.

Some deprecated APIs are even insecure (or at least prone to incorrect usage) which
can have serious security implications. For that reason, standard now considers
usage of Buffer(num) to be an error, since this function returns uninitialized
program memory which could contain confidential information like passwords or keys.

Instead of Buffer(num), consider using Buffer.alloc(num) or Buffer.from(obj)
which make the programmer's intent clearer. These functions exist in all currently
supported versions of Node.js, including Node.js 4.x. For more background,
see this Node.js issue.

We also improved some rules to support common patterns in code bases that use
React, JSX, and Flow.

When you upgrade, consider running standard --fix to automatically fix some of
the issues caught by this new version.

New features
  • Update ESLint from 3.15.x to 3.19.x.
  • Node.js API: Add standard.lintTextSync method
New rules

(Estimated % of affected standard users, based on test suite in parens)

Changed rules
  • Relax rule: allow using ...rest to omit properties from an object (no-unused-vars) #​800
    • This is a common and useful pattern in React/JSX apps!
  • Relax rule: allow Flow import type statements (import/no-duplicates) #​599
    • These are no longer considered to be "duplicate imports"
  • Relax rule: Treat process.exit() the same as throw in code path analysis (node/process-exit-as-throw) #​699
    • Makes certain other rules work better and give fewer false positives
  • Relax rule: allow Unnecessary Labels (no-extra-label)
    • Redundant, since "no-labels" is already enabled, which is more restrictive

v9.0.2

Compare Source

Changed rules

v9.0.1

Compare Source

Changed rules
  • Relax rule: Allow mixing basic operators without parens (no-mixed-operators) #​816
    • Specifically, these operators: +, -, *, /, %, and **

v9.0.0

Compare Source

It's time for a new major version of standard! As usual, this release contains a
bunch of awesomeness to help you keep your code in tip-top shape!

We've added several new rules designed to catch potential programmer errors
(i.e. bugs), as well as rules to make programmer intent more explicit in
certain circumstances.

This release continues our trend of tightening up rules so that, wherever possible,
there's one "right" way to do things. This design goal is intended to reduce the
time that teams and maintainers spend giving code review feedback in pull requests.

When you upgrade, consider running standard --fix to automatically fix some of the
errors caught by the new rules in this version.

Note: If you use the Chai test framework, you will need to make some changes to
your tests to improve their robustness. Read about the changes you need to make.

New features
  • Update ESLint from 3.10.x to 3.15.x
  • 3 additional rules are now fixable with standard --fix
New rules

(Estimated % of affected standard users, based on test suite in parens)

Changed rules

v8.6.0

Compare Source

  • Update ESLint from 3.8.x to 3.10.x
  • 3 additional rules are now fixable with standard --fix

v8.5.0

Compare Source

  • Update ESLint from 3.7.x to 3.8.x
  • 2 additional rules are now fixable with standard --fix

v8.4.0

Compare Source

  • Update ESLint from 3.6.x to 3.7.x
  • 5 additional rules are now fixable with standard --fix
  • Use more conservative semver ranges #​654

v8.3.0

Compare Source

The last release (8.2.0) added ES7 support. This release (8.3.0) adds ES8
support ...just 3 days later!

This release should eliminate the need to specify babel-eslint as a custom
parser, since standard can now parse ES8 (i.e. ES2017) syntax out of the box.
That means async and await will just work.

  • Support ES8 (i.e. ES2017) syntax.

v8.2.0

Compare Source

For many users, this release should eliminate the need to specify babel-eslint as
a custom parser, since standard can now parse ES7 (i.e. ES2016) syntax out of the
box.

  • Support ES7 (i.e. ES2016) syntax.
  • Update ESLint from 3.5.x to 3.6.x
  • 4 additional rules are now fixable with standard --fix

v8.1.0

Compare Source

  • Update ESLint from 3.3.x to 3.5.x
  • Around 10 additional rules are now fixable with standard --fix

v8.0.0

Compare Source

This release contains a bunch of goodies, including new rules that catch potential
programmer errors (i.e. bugs) and enforce additional code consistency.

However, the best feature is surely the new --fix command line flag to
automatically fix problems. If you ever used
standard-format
and ran into issues with the lack of ES2015+ support, you'll be happy about
--fix.

standard --fix is built into standard v8.0.0 for maximum convenience, it
supports ES2015, and it's lightweight (no additional dependencies since it's part
of ESLint which powers standard). Lots of problems are already fixable, and more
are getting added with each ESLint release.

standard also outputs a message ("Run standard --fix to automatically fix
some problems.") when it detects problems that can be fixed automatically so you
can save time!

With standard v8.0.0, we are also dropping support for Node.js versions prior to
v4. Node.js 0.10 and 0.12 are in maintenance mode and will be unsupported at the
end of 2016. Node.js 4 is the current LTS version. If you are using an older
version of Node.js, we recommend upgrading to at least Node.js 4 as soon as
possible. If you are unable to upgrade to Node.js 4 or higher, then we recommend
continuing to use standard v7.x until you are ready to upgrade Node.js.

Important: We will not be updating the standard v7.x versions going forward.
All bug fixes and enhancements will land in standard v8.x.

Full changelog below. Cheers!

New features
New rules

(Estimated % of affected standard users, based on test suite in parens)

Changed rules
  • Relax rule: Allow template literal strings (backtick strings) to avoid escaping #​421
  • Relax rule: Do not enforce spacing around * in generator functions (#​564 (comment))
    • This is a temporary workaround for babel users who use async generator functions.

v7.1.2

Compare Source

  • Fix install errors for some users by updating eslint peer dependency

v7.1.1

Compare Source

  • Add back full node 0.10, 0.12 support

v7.1.0

Compare Source

  • Upgrade eslint to version 2.10.2.

v7.0.1

Compare Source

  • Relax "no-duplicate-imports" rule to not include export so the following is allowed:
import { foo } from 'bar'
export * from 'bar'

v7.0.0

Compare Source

v6.0.8

Compare Source

  • Pin eslint to version ~2.2.0
  • Update eslint-plugin-react to version 4.0.0

v6.0.7

Compare Source

  • Revert: Use install location of standard as eslint cwd (fixes #​429)

v6.0.6

Compare Source

  • Use eslint 2.1.0
  • Fix: Use install location of standard as eslint cwd (fixes snazzy/#​8)

v6.0.5

Compare Source

  • Use eslint 2.0.0 stable

v6.0.4

Compare Source

  • Update eslint from ~7.13.1 to ~7.18.0
  • Update eslint-config-standard from 16.0.2 to 16.0.3
  • Update eslint-plugin-import from ~2.22.1 to ~2.24.2
  • Update eslint-plugin-promise from ~4.2.1 to ~5.1.0
  • Update eslint-plugin-react from ~7.21.5 to ~7.25.1

v6.0.3

Compare Source

  • Update eslint from ~7.12.1 to ~7.13.0
  • Relax rule: Enforce default parameters to be last #​1414

v6.0.2

Compare Source

  • Allow standard to run on Node 11, even though it's not officially supported #​1597

v6.0.1

Compare Source

  • Introduce "warning" system for disruptive rules (read more below)
  • Change rule to a "warning": Require let or const instead of var (no-var) #​633

standard treats all rule violations as errors, which means that standard
will exit with a non-zero (error) exit code.

However, we may occasionally release a new major version of standard
which changes a rule that affects the majority of standard users (for example,
transitioning from var to let/const). We do this only when we think the
advantage is worth the cost and only when the rule is
auto-fixable.

In these situations, we have a "transition period" where the rule change is only
a "warning". Warnings don't cause standard to return a non-zero (error)
exit code. However, a warning message will still print to the console. During
the transition period, using standard --fix will update your code so that it's
ready for the next major version.

The slow and careful approach is what we strive for with standard. We're
generally extremely conservative in enforcing the usage of new language
features. We want using standard to be light and fun and so we're careful
about making changes that may get in your way. As always, you can
disable a rule at any time, if necessary.

v6.0.0

Compare Source

We're super excited to announce standard 16!

As with every new major release, there are lots of new rules in 16.0.0 designed
to help catch bugs and make programmer intent more explicit. This release brings
better performance, tons of bug fixes, improved JSX, React ⚛️, and Next.js support!

When you upgrade, consider running standard --fix to automatically format your
code to match the newly added rules.

❤️ If you enjoy StandardJS and want to support future releases, please
support Feross!

New features
  • 🏎 Better performance: the filesystem doesn't need to be traversed multiple times! #​1023

    • Massive improvements (on the order of minutes!) for projects with huge folders which are are ignored with .gitignore
  • 🌟 Support the .gitignore ignore syntax from the command line #​1117

    • In older versions, the command standard src would not lint the src/ folder
    • Instead, a glob pattern like standard src/**/*.js was required
    • This is now fixed! You can run standard src to lint the src/ folder!
  • 🌟 Support relative paths from the command line in more situations (e.g. standard ../src/*.js) #​1384

  • 🌟 New extensions option for linting additional extensions besides .js, .jsx, .mjs, and .cjs

    • Can be configured with the --ext command line flag or in package.json:

    • Example:

      standard --ext .ts
      {
        "standard": {
          "extensions": [".ts"]
        }
      }
  • 🌟 New cache directory location, respecting XDG_CACHE_HOME preference, with fallback to ~/.cache/standard standard-engine/#​214

Changed features
  • Update eslint from ~7.11.0 to ~7.12.1

  • Update standard-engine from ^12 to ^14

    • Fix inaccurate --help command which indicates that bundle.js is automatically ignored when it is not anymore standard-engine/#​224
    • Remove deglob package and use built-in ESLint folder-traversal support
  • Paths with square brackets (e.g. [ and ]) are no longer skipped #​1333

    • This pattern is particularly common in Next.js apps, e.g. blog/[slug].js
    • You may notice new errors in these files since they were not being linted before
  • Better mono-repo support: Nested node_modules/ folders are ignored by default #​1182

  • Remove eslint-plugin-standard #​1316

    • We migrated the remaining no-callback-literal rule into eslint-plugin-node
New rules

(Estimated % of affected standard users, based on test suite in parens)

Changed rules
  • Relax rule: JSX: Consider the global scope when checking for defined Components #​1115
  • Relax rule: JSX: Remove conflicting indentation rule in indent #​1499

v5.4.1

Compare Source

view diff

Fixed
  • Fix for standard-engine change. Fix error tagline.

v5.4.0

Compare Source

view diff

Added
  • eslint-config-standard-react@1.2.0
    • Disallow duplicate JSX properties

v5.3.1

Compare Source

view diff

Changed
  • eslint-plugin-react@3.4.2

v5.3.0

Compare Source

view diff

Changed
  • eslint-config-standard@4.4.0 ([history][eslint-config-standard])
    • New rule: must have space after semicolon in for-loop (commit)
    • New rule: No default assignment with ternary operator (commit)
    • New rule: Require spaces before keywords (commit)
  • eslint-config-standard-react@1.1.0 ([history][eslint-config-standard-react])
  • eslint-plugin-react@3.4.0 ([history][eslint-plugin-react])
  • eslint-plugin-standard@1.3.1 ([history][eslint-plugin-standard])

v5.2.2

Compare Source

view diff

Fixed
  • We have a changelog now, and you're reading it!
  • Minor README update
  • Removed direct dependency on eslint (its now moved to standard-engine)

v5.2.1

Compare Source

view diff

Changed
  • eslint-config-standard@4.3.1 ([history][eslint-config-standard])
    • Revert rule: Disallow unncessary concatenation of strings
Fixed
  • eslint-config-standard@4.3.1 ([history][eslint-config-standard])
    • fix regression with ternary operator handling

v5.2.0

Compare Source

view diff

Added
  • eslint-config-standard@4.3.0 ([history][eslint-config-standard])
    • New rule: Disallow unncessary concatenation of strings
    • New rule: Disallow duplicate name in class members
    • New rule: enforce spaces inside of single line blocks
    • Re-add rule: padded-blocks (Closes #​170)
Changed
  • Bump eslint from 1.1.0 to 1.3.1 ([CHANGELOG][eslint])
  • eslint-plugin-standard@1.3.0 ([history][eslint-plugin-standard])
    • A small change to make the plugin compatible with browserify which does not affect behavior.
Fixed
  • eslint-plugin-react@3.3.1 ([CHANGELOG][eslint-plugin-react])
    • Fix object rest/spread handling.
  • Added white background to badge.svg to make it work with dark backgrounds (Closes #​234)
  • Minor updates to README.md

v5.1.1

Compare Source

view diff

Fixed
  • Update to RULES.md to remove a missing hyperlink
  • Add atom linter information to README.md
  • Fixed duplicated word in the tagline message on the CLI
  • Removed failing repository from tests (yoshuawuyts/initialize)

v5.1.0

Compare Source

view diff

Fixed
  • eslint-config-standard@4.1.0 ([history][eslint-config-standard])
  • eslint-plugin-react@3.2.2 ([CHANGELOG][eslint-plugin-react])
    • Fix crash when propTypes don't have any parent
    • Fix jsx-no-literals reporting errors outside JSX
Changed
  • Bump eslint from 1.0.0 to 1.2.0 ([CHANGELOG][eslint])
  • Added more test repositories and disabled some that were failing
  • Update bikeshedding link on README.md

v5.0.2

Compare Source

view diff

Changed
  • eslint-config-standard-react@1.0.4 ([history][eslint-config-standard-react])
    • Disable Rule: react/wrap-multilines
  • Minor README updates

v5.0.1

Compare Source

v5.0.0

Compare Source

We're super excited to announce standard 15!

As with every new major release, there are lots of new rules in 15.0.0 designed
to help catch bugs and make programmer intent more explicit. This release brings
support for ES 2021, the latest version of the ECMAScript specification, as well
as many quality-of-life improvements, including ESLint v7.

When you upgrade, consider running standard --fix to automatically format your
code to match the newly added rules.

❤️ If you enjoy StandardJS and want to support future releases, check out
Feross's GitHub Sponsors page.

New features
Changed features
  • BREAKING: Node.js 8 is no longer supported
    • Node.js 8 is EOL and will no longer be receiving security updates.
    • To prevent breaking CI for projects which still support Node 8, standard silently passes when run by an unsupported version of Node
  • Update eslint from ~6.8.0 to ~7.11.0
New rules

(Estimated % of affected standard users, based on test suite in parens)

Changed rules
  • Relax rule: Allow function declarations in nested blocks #​1406
  • Relax rule: Removed redundant no-negated-in-lhs rule, already enforced by no-unsafe-negation eslint-config-standard/#​160

  • If you want to rebase/retry this PR, click this checkbox.

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by WhiteSource label Feb 4, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
security fix Security fix generated by WhiteSource
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants