chore(lint): bump shared lint dependency, fix issues #1209
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the shared ESLint configuration dependency and addresses the lint issues it introduced. The changes primarily focus on preventing prototype pollution vulnerabilities by ensuring object literals don't inherit from Object.prototype, and updating a test assertion to use a more appropriate query method.
- Bumped
@mongodb-js/eslint-config-devtoolsfrom version 0.9.12 to 0.11.2 - Fixed prototype pollution issues by using
Object.create(null)or__proto__: nullfor object literals used as dictionaries - Updated test assertion to use
queryByLabelTextinstead of wrappinggetByLabelTextin an expect-not-throw pattern
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Updated ESLint config dependency to version 0.11.2 |
| src/test/suite/views/webview-app/resources-panel.test.tsx | Changed test assertion to use queryByLabelText for checking element non-existence |
| src/test/suite/telemetry/telemetryService.test.ts | Added __proto__: null to mappedTypes object literal to prevent prototype pollution |
| src/mcp/mcpController.ts | Added __proto__: null to headers object literal to prevent prototype pollution |
| src/explorer/connectionTreeItem.ts | Changed object literal initialization to Object.create(null) for cache objects |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| databases.sort((a: string, b: string) => a.localeCompare(b)); | ||
|
|
||
| const newChildrenCache: Record<string, DatabaseTreeItem> = {}; | ||
| const newChildrenCache: Record<string, DatabaseTreeItem> = |
There was a problem hiding this comment.
That one is from pulling in a new rule https://github.com/mongodb-js/devtools-shared/blob/main/configs/eslint-plugin-devtools/rules/no-plain-object-records.js
We added in mongodb-js/devtools-shared#604
The rule might not be suggesting quite the right fix here though, it's breaking the ts check in other places when it's applied. Looking into it a bit more.
Anemy
added
the
no-title-validation
No description provided.