chore: lint against runtime imports of devDependencies#852
Merged
Conversation
Adds the `import/no-extraneous-dependencies` eslint rule (via
eslint-plugin-import) so `npm run lint` fails when a runtime source
file imports a package that is only listed in devDependencies. Those
get stripped when the extension is packaged into a .vsix, which caused
the 2.67.1 activation crash ("Cannot find module 'dayjs/...'").
The rule runs inside the existing lint step, which is already part of
CI (build.yml) and the `preversion` gate.
Also fixes the issues the new rule surfaced:
- move `lodash` from devDependencies to dependencies (imported at
runtime in DeviceManager.ts and LocalPackageManager.ts)
- scope-disable the rule for the intentional optional `@parcel/watcher`
require (dev-only, wrapped in try/catch)
- disable the rule for *.spec.ts files, which only run with
devDependencies installed
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
2.67.1extension crashed on activation withCannot find module 'dayjs/plugin/relativeTime'. Root cause:dayjswas imported at runtime but listed only indevDependencies, which get stripped when the extension is packaged into a.vsix. That was fixed in #850 — this PR adds tooling so the whole class of bug fails CI instead of shipping to users.What
Adds the
import/no-extraneous-dependenciesrule (viaeslint-plugin-import). It failsnpm run lintwhen a runtime source file imports a package not listed independencies. This runs inside the existing lint step, which is already part of CI (build.yml) and thepreversiongate — no new CI surface.Config choices:
devDependenciesallowed only inscripts/**,benchmarks/**, and config files*.spec.tsfiles exempt entirely (they only run when devDependencies are installed)optionalDependencies: false,peerDependencies: trueIssues the new rule surfaced (also fixed here)
lodash— imported at runtime inDeviceManager.tsandLocalPackageManager.tsbut only a devDependency → moved todependencies. (Same latent crash as dayjs.)@parcel/watcher— an intentional dev-only optionalrequire()wrapped in try/catch → added a scopedeslint-disablerather than promoting it to a prod dep.Limitations
This is a source-level heuristic: it catches static
import/requireof undeclared packages (the common case), but won't catch dynamicrequire(variable)paths. It's the cheapest, earliest catch; a packaged-artifact smoke test would be a stronger (heavier) complement if we want one later.🤖 Generated with Claude Code