chore(deps): bump eslint-plugin-vue from 9.33.0 to 10.10.0 - #15128
chore(deps): bump eslint-plugin-vue from 9.33.0 to 10.10.0#15128dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
🔵 Review postedLast updated: 2026-08-02 21:21 UTC |
npm Package VersionsWarning The following packages have changed files but no version bump:
If these changes affect published code, consider bumping the version. |
Build Artifacts
Smoke test screenshot |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15128 — eslint-plugin-vue 9.33.0 → 10.10.0.
| Semver risk | Major (one major cycle + 10 minors) |
| Dependency type | dependencies of eslint-plugin-kolibri and kolibri-format — dev tooling, but a declared runtime dep of two publishable packages |
| CI | Failing — All file linting, Frontend tests (checked at a8283858, current HEAD, not stale) |
Breaking changes in v10.0.0 that matter here:
- #2669 New minimums: Node
^18.18.0 || ^20.9.0 || >=21.1.0, ESLint^8.57.0 || ^9.0.0— satisfied (repo is oneslint@^9.39.0, CI Node 20.19.3). - #2670 / #2697
vue-eslint-parseris now a required peer at^10.3.0— not satisfied, see below. - #2674 Globals removed from configs — no impact;
packages/kolibri-format/eslint.config.mjssetsglobals.browser/node/es2015/jestexplicitly. - #2645 Deprecated rules removed — no impact; all 32
vue/*rules configured ineslint.config.mjsstill ship in 10.10.0, andflat/vue2-recommendedis still published. - #2675 Vue-2-only rules deprecated, slated for removal in v11. Kolibri is on Vue 2.7 and spreads
flat/vue2-recommended. Nothing to do here, but worth an issue so the next major isn't a surprise. - Unversioned in the release notes but breaking for us: the published directory moved
lib/→dist/.
No security fixes in the range.
blocking — the lib/ → dist/ move breaks 12 deep imports. v10 publishes "files": ["dist"] / "main": "dist/index.js" with no exports aliases, so every require('eslint-plugin-vue/lib/...') throws MODULE_NOT_FOUND. requireindex loads every rule module, so one bad require takes down the whole kolibri plugin — which is why kolibri-format fails on every .vue file, not just linting:
[ERROR: Kolibri Format] Error: Cannot find module 'eslint-plugin-vue/lib/utils'
Require stack:
- packages/eslint-plugin-kolibri/lib/utils.js
- packages/eslint-plugin-kolibri/lib/rules/tests-no-hardcoded-strings.js
Call sites (all under packages/eslint-plugin-kolibri/lib/): utils.js:3, rules/vue-component-block-tag-newline.js:7, rules/vue-component-block-padding.js:8, rules/vue-no-rtl-breaking-inline-styles.js:6, rules/vue-no-unused-vuex-methods.js:8, rules/vue-string-objects-formatting.js:7, rules/vue-component-require-img-src.js:1, rules/vue-no-unused-vuex-properties.js:8, rules/vue-no-unused-translations.js:7, rules/vue-no-undefined-string-uses.js:7, rules/vue-watch-no-string.js:7, plus rules/vue-component-no-duplicate-ids.js:5 and rules/vue-component-class-name-casing.js:5-6 which use a double-slash lib//utils form. Fix is mechanical (lib/ → dist/; both target files exist in the 10.10.0 tarball and the package is still CJS), but all 12 need doing in one pass.
blocking — vue-eslint-parser peer is out of range. v10 requires ^10.3.0; the repo pins ^9.4.3 (packages/eslint-plugin-kolibri/package.json:21) and that's the only version in the lockfile (pnpm-lock.yaml:9701), which records the mismatch verbatim: eslint-plugin-vue@10.10.0(...)(vue-eslint-parser@9.4.3(...)). Upstream fixed exactly this pairing in 10.9.1 ("Updated peer dependency version for vue-eslint-parser to fix parsing errors in Vue SFCs", vuejs/eslint-plugin-vue#3075). Bump the parser alongside; it's also used directly by packages/eslint-plugin-kolibri/tests/helpers.js:4, so re-run pnpm test-jest --testPathPattern eslint-plugin-kolibri rather than trusting the lockfile.
suggestion — version bumps. The npm-versions bot flagged that eslint-plugin-kolibri 1.1.1 and kolibri-format 2.4.0 changed without a version bump. Neither is private, and in both cases the change is a major range change under dependencies. Fixing the two blockers will also touch eslint-plugin-kolibri's rule sources, which strengthens the case.
This can't land as a manifest-and-lockfile-only change.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
| }, | ||
| "dependencies": { | ||
| "eslint-plugin-vue": "^9.33.0", | ||
| "eslint-plugin-vue": "^10.10.0", |
There was a problem hiding this comment.
blocking: This package's 12 rule modules deep-import eslint-plugin-vue/lib/..., which v10 moved to dist/ — every one throws MODULE_NOT_FOUND under 10.10.0, taking down the whole plugin via requireindex. Also bump vue-eslint-parser (line 21) from ^9.4.3 to ^10.3.0 to satisfy v10's required peer. Details in the review summary.
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15128 — eslint-plugin-vue 9.33.0 → 10.10.0 (major, dev-only tooling: a dependencies entry of the internal eslint-plugin-kolibri package plus a devDependencies entry of kolibri-format). No new commits since the last review — HEAD is still a8283858, and both blocking findings are unchanged. CI is red: Javascript Tests and Linting both fail at a828385 (Run tests, Run prek).
Breaking changes requiring code changes here:
- v10 ships only
dist/("files": ["dist"],"main": "dist/index.js", noexportsaliases).packages/eslint-plugin-kolibrideep-importseslint-plugin-vue/lib/**at 14 sites across 13 files —lib/utils.js:3,lib/rules/vue-component-require-img-src.js:1,vue-watch-no-string.js:7,vue-component-class-name-casing.js:5,6,vue-component-no-duplicate-ids.js:5,vue-no-unused-translations.js:7,vue-no-rtl-breaking-inline-styles.js:6,vue-no-unused-vuex-properties.js:8,vue-component-block-padding.js:8,vue-string-objects-formatting.js:7,vue-no-undefined-string-uses.js:7,vue-component-block-tag-newline.js:7,vue-no-unused-vuex-methods.js:8. Each throwsMODULE_NOT_FOUND, and becauserequireindexeagerly loads every rule module a single failure takes the wholekolibriplugin down — henceRun prekfailing on every.vuefile rather than on one rule. The fix is mechanical (lib/→dist/; both targets exist in the 10.10.0 tarball, still CJS), but all 14 sites need doing in one pass. Two of them have a stray double slash (lib//utils) worth cleaning up at the same time. - Peer dependency change: v10 requires
vue-eslint-parser@^10.3.0(vuejs/eslint-plugin-vue#2670, #2697); 10.9.1 shipped specifically to correct this pairing.packages/eslint-plugin-kolibri/package.json:21still pins^9.4.3, and that is the only version in the lockfile. Bump it alongside the plugin, then re-runpnpm test-jest --testPathPattern eslint-plugin-kolibri—tests/helpers.js:4imports the parser directly, so lockfile resolution alone isn't evidence.
Security fixes in range: none.
suggestion — both publishable packages are flagged by the npm-versions bot as changed without a version bump (eslint-plugin-kolibri 1.1.1, kolibri-format 2.4.0). Neither is private and both changes are a major range change under dependencies. Fixing the blockers will touch eslint-plugin-kolibri's rule sources anyway.
suggestion — vuejs/eslint-plugin-vue#2675 deprecates the Vue-2-only rules for removal in v11. Kolibri is on Vue 2.7 and spreads flat/vue2-recommended. Nothing to do here, but worth an issue so the next major isn't a surprise.
Prior-finding status
UNADDRESSED — packages/eslint-plugin-kolibri/lib/utils.js:3 — deep imports of eslint-plugin-vue/lib/** broken by the lib/ → dist/ move
UNADDRESSED — packages/eslint-plugin-kolibri/package.json:21 — vue-eslint-parser peer still ^9.4.3, needs ^10.3.0
UNADDRESSED — packages/eslint-plugin-kolibri/package.json:1 — version bumps for eslint-plugin-kolibri / kolibri-format
ACKNOWLEDGED — packages/eslint-plugin-kolibri/package.json:13 — track the Vue-2 rule deprecations before v11
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
Bumps [eslint-plugin-vue](https://github.com/vuejs/eslint-plugin-vue) from 9.33.0 to 10.10.0. - [Release notes](https://github.com/vuejs/eslint-plugin-vue/releases) - [Changelog](https://github.com/vuejs/eslint-plugin-vue/blob/master/CHANGELOG.md) - [Commits](vuejs/eslint-plugin-vue@v9.33.0...v10.10.0) --- updated-dependencies: - dependency-name: eslint-plugin-vue dependency-version: 10.10.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
a828385 to
5fb97b6
Compare
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #15128 — eslint-plugin-vue 9.33.0 → 10.10.0. Major, dev-only, no security fixes. CI failing at 5fb97b6e43. Nothing resolved — diff unchanged.
[blocking] v10 moved lib/ → dist/, no exports aliases. 14 requires throw MODULE_NOT_FOUND; requireindex takes down the whole plugin (linting, tests). Rewrite all 14 to dist/, plus two lib// typos:
lib/utils.js:3
lib/rules/vue-component-require-img-src.js:1
lib/rules/vue-no-rtl-breaking-inline-styles.js:6
lib/rules/vue-watch-no-string.js:7
lib/rules/vue-no-undefined-string-uses.js:7
lib/rules/vue-string-objects-formatting.js:7
lib/rules/vue-no-unused-translations.js:7
lib/rules/vue-component-block-tag-newline.js:7
lib/rules/vue-component-block-padding.js:8
lib/rules/vue-no-unused-vuex-properties.js:8
lib/rules/vue-no-unused-vuex-methods.js:8
lib/rules/vue-component-no-duplicate-ids.js:5 (lib//utils)
lib/rules/vue-component-class-name-casing.js:5,6 (lib//utils, lib//utils/casing)
[blocking] package.json:21 pins vue-eslint-parser@^9.4.3; v10 needs ^10.3.0 (#2670, #2697); pnpm-lock.yaml:14858 confirms. tests/helpers.js:4 imports it directly — re-run pnpm test-jest --testPathPattern eslint-plugin-kolibri.
[suggestion] eslint-plugin-kolibri 1.1.1, kolibri-format 2.4.0 unbumped.
Prior-finding status
UNADDRESSED — packages/eslint-plugin-kolibri/lib/utils.js:3 — broken deep imports
UNADDRESSED — packages/eslint-plugin-kolibri/package.json:21 — parser peer ^9.4.3
UNADDRESSED — packages/eslint-plugin-kolibri/package.json:1 — version bumps
ACKNOWLEDGED — packages/eslint-plugin-kolibri/package.json:13 — Vue-2 deprecations
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
2 participants
Bumps eslint-plugin-vue from 9.33.0 to 10.10.0.
Release notes
Sourced from eslint-plugin-vue's releases.
... (truncated)
Changelog
Sourced from eslint-plugin-vue's changelog.
... (truncated)
Commits
03abb27Version Packages (#3087)68da3d8docs: More accurate example inprefer-single-event-payload(#3089)d117769docs: complete component detection patterns (#3098)8e26efdFix prefer-separate-static-class for template literals (#3097)a7e0b75Update development dependencies (#3095)51a1c2dUpdate dependencies (#3094)52de0e4Update development dependencies (#3093)c539b98Update eslint-plugin-unicorn to v70 (#3092)648e21eUpdate ESLint to v10 for development (#3090)9b8a697Update Prettier to v3.9 (#3091)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for eslint-plugin-vue since your current version.