chore(pnpm-migration): remove lint-staged#7738
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
There was a problem hiding this comment.
Pull Request Overview
This PR removes the locally installed lint-staged dependency as it is no longer required, given that the latest version is automatically downloaded via pnpm dlx.
- Removed the lint-staged dependency from package.json.
- Updated the dependabot configuration by eliminating lint-staged from its tracked dependencies.
Reviewed Changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Removed the lint-staged dependency from the dependencies list. |
| .github/dependabot.yml | Removed lint-staged from the list of dependencies monitored by dependabot. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
Comments suppressed due to low confidence (2)
package.json:35
- Removing the lint-staged dependency is appropriate given that it's no longer required; ensure that any related scripts or configuration are updated accordingly.
"lint-staged": "15.5.1",
.github/dependabot.yml:29
- The removal of lint-staged from dependabot's configuration aligns with the dependency removal; confirm that dependabot is not expected to monitor this package elsewhere.
- lint-staged
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7738 +/- ##
=======================================
Coverage 74.84% 74.84%
=======================================
Files 98 98
Lines 7888 7888
Branches 200 200
=======================================
Hits 5904 5904
Misses 1983 1983
Partials 1 1 ☔ View full report in Codecov by Sentry. |
MattIPv4
left a comment
There was a problem hiding this comment.
I am -1 on removing this, we should update the husky command to use the locally installed version. Pulling down the latest on every commit feels very dangerous
|
I agree with Matt |
Agreed. Husky should run local version, we should reduce attack vectors. |
|
Got it. I'll replace this PR with one that replaces |
From what I can tell, we do not need this as a dependency.
https://github.com/nodejs/nodejs.org/blob/main/.husky/pre-commit downloads the latest version via
pnpm dlx, and ignores the locally installed version, so why do we even have a locally installed version?