Skip to content

Update dev dependencies #119

@milantenk

Description

@milantenk

Goal

Update all outdated devDependencies to their latest major versions and perform the necessary configuration migrations to keep the project maintainable and secure.

Problem

Most devDependencies are multiple major versions behind and some introduce security vulnerabilities:

Package Current Latest
eslint ^6.8.0 ^10.0.3
husky ^4.2.3 ^9.1.7
jasmine-node ^1.16.0 ^3.0.0 (CVEs, see below)
lint-staged ^10.0.8 ^16.3.2
postcss ^8.0.0 ^8.5.8
prettier ^1.19.1 ^3.8.1

Additionally, the CI workflow tests against Node.js 8, 10, and 12 — all of which are End-of-Life.

Plan

Replace jasmine-node with jasmine

jasmine-node@3 (the latest version) has unresolvable critical CVEs in its transitive dependencies (underscore, minimatch). Migrate to the official jasmine package, which is the actively maintained successor and a drop-in replacement for this test suite.

Migrate ESLint to flat config

ESLint v9+ dropped support for the legacy .eslintrc.* format:

  • Delete .eslintrc.js and example/.eslintrc.js
  • Create eslint.config.js with equivalent rules

Migrate Husky to v9

Husky v5+ dropped the package.json-based hooks format:

  • Remove husky.hooks block from package.json
  • Add "prepare": "husky" script to package.json
  • Create .husky/pre-commit shell script

Update CI workflow

  • Update Node.js matrix from [8.x, 10.x, 12.x] to [18.x, 20.x, 22.x]
  • Bump actions/checkout@v2v4 and actions/setup-node@v1v4
  • Replace npm install with npm ci for reproducible installs
  • Add cache: 'npm' to speed up CI runs

Fix stale test assertion

The test "should remain unitless if 0" was never updated after commit a90b209 changed how zero values are handled. Correct the expected value (0px0rem).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions