Skip to content

Conversation

@sarahdayan
Copy link
Member

@sarahdayan sarahdayan commented Feb 3, 2026

Summary

  • Convert require() to dynamic import() in updateChangelog.js for config loading
  • Replace .toString() with 'utf-8' encoding parameter in readFileSync() calls across the codebase
  • Fix require('path') to import path from 'path' in updateChangelog.spec.js

Files changed

shipjs-lib:

  • src/lib/util/updateVersion.js - use 'utf-8' encoding

shipjs:

  • src/step/prepare/updateChangelog.js - convert require() to dynamic import()
  • src/step/prepare/__tests__/updateChangelog.spec.js - convert require to import
  • src/helper/extractSpecificChangelog.spec.js - remove unused import.meta.url import
  • src/helper/dependencyUpdater.js - use 'utf-8' encoding
  • src/helper/getChangelog.js - use 'utf-8' encoding
  • src/helper/runPrettier.js - use 'utf-8' encoding
  • src/step/setup/addDevDependencies.js - use 'utf-8' encoding
  • src/step/setup/addScriptsToPackageJson.js - use 'utf-8' encoding
  • src/step/setup/addShipConfig.js - use 'utf-8' encoding
  • src/step/setup/askQuestions.js - use 'utf-8' encoding

@sarahdayan sarahdayan requested review from a team, FabienMotte and aymeric-giraudet and removed request for a team February 3, 2026 11:59
@FabienMotte
Copy link

Should we add a .codacy.yml file to ignore the false positives on Codacy?

@sarahdayan
Copy link
Member Author

@FabienMotte Done! Added .codacy.yml in edd2c07 to exclude test directories from security rules.

The updateChangelog.js warning about user input in path.resolve may still appear since it's not in a test directory, but that's intentional CLI behavior (loading user-provided config files). We can add a more specific rule if needed, but I'd leave it as documentation that this pattern is deliberate.

@sarahdayan sarahdayan requested a review from dhayab February 3, 2026 14:50
Copy link

@FabienMotte FabienMotte left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

Sarah Dayan and others added 3 commits February 3, 2026 16:04
Update build tooling for shipjs-lib:

- rollup: 2.14.0 → 4.34.8
- rollup-plugin-commonjs → @rollup/[email protected]
- rollup-plugin-node-resolve → @rollup/[email protected]

Updated rollup.config.js to use the new scoped plugin packages
and createRequire for JSON imports (ESM compatible).

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Update linting tooling:

ESLint:
- eslint: 7.2.0 → 8.57.1
- eslint-config-algolia: 16.0.0 → 20.0.0
- eslint-config-prettier: 6.11.0 → 8.10.0
- eslint-plugin-import: 2.20.2 → 2.31.0
- eslint-plugin-jest: 23.13.2 → 27.9.0
- eslint-plugin-prettier: 3.1.3 → 4.2.1
- eslint-plugin-jsdoc: added 46.10.1

Parser:
- babel-eslint → @babel/[email protected]

Updated .eslintrc.cjs to use @babel/eslint-parser and disable
removed/incompatible rules.

Note: Prettier remains at 2.x due to ESM compatibility issues
with Jest. Prettier 3.x upgrade can be done in a future PR.

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Auto-fixed lint errors from ESLint 8 stricter rules:
- import/order: Sorted imports by group (builtin, external, internal)
- import/newline-after-import: Added newlines after imports
- no-else-return: Removed unnecessary else after return
- jest/prefer-to-be: Use toBe/toBeNull for primitive checks

Also fixed a buggy mock in updateVersionMonorepo.spec.js that was
attempting to spy on a non-existent property.

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Sarah Dayan and others added 3 commits February 3, 2026 16:05
Update testing and transpilation tooling:

Jest ecosystem:
- jest: 26.0.1 → 29.7.0
- babel-jest: 26.0.1 → 29.7.0
- jest-watch-typeahead: 0.6.0 → 2.2.2

Babel ecosystem (required for Jest 29 compatibility):
- @babel/core: 7.10.2 → 7.26.9
- @babel/preset-env: 7.10.2 → 7.26.9
- @babel/plugin-transform-runtime: 7.10.1 → 7.26.9
- @babel/runtime: ^7.6.3 → ^7.28.6

Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Convert require() to dynamic import() in updateChangelog.js
- Replace .toString() with 'utf-8' encoding parameter in readFileSync calls
- Fix 'require' to 'import' in updateChangelog.spec.js

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Exclude test directories from security-focused rules. Tests legitimately
use dynamic paths (e.g., __dirname + path.resolve) to load fixtures,
which triggers false positive "path injection" warnings.

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Base automatically changed from chore/update-eslint to main February 3, 2026 15:34
@sarahdayan sarahdayan enabled auto-merge (squash) February 3, 2026 16:05
@sarahdayan sarahdayan disabled auto-merge February 3, 2026 16:06
@sarahdayan sarahdayan merged commit 3195b0a into main Feb 3, 2026
1 of 2 checks passed
@sarahdayan sarahdayan deleted the chore/fix-commonjs branch February 3, 2026 16:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants