Eslint-plugin-vue: ESLint 6 compatibility

[jtsom]

Tell us about your environment

• ESLint version: 6.0.1
• eslint-plugin-vue version: 5.2.3
• Node version: 12.5.0

Upgrading to ESLint v6 shows warnings when installing:
npm WARN [email protected] requires a peer of eslint@^5.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of eslint@^5.0.0 but none is installed. You must install peer dependencies yourself

[719media]

I hit this same warning. I looked to see if the package.json for vue-eslint-parser@6was using eslint 6 yet (to see if whenever eslint-plugin-vue gets around to updating to vue-eslint-parser@6 it may alleviate the problem), but it's also still peerDependency on eslint 5, so I'm not sure if there are compat reasons that the authors know about which makes this difficult to just change.

[davidpelayo]

It got added to the code at this commit. However, no new version has been released to npm, AFAIK. At least, I still see the node_modules/eslint-plugin-vue/package.json with the following:

{
  "peerDependencies": {
    "eslint": "^5.0.0"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/vuejs/eslint-plugin-vue.git"
  },
  "scripts": {
    "docs:build": "vuepress build docs",
    "docs:watch": "vuepress dev docs",
    "lint": "eslint . --rulesdir eslint-internal-rules",
    "pretest": "npm run lint",
    "preversion": "npm test && npm run update && git add .",
    "start": "npm run test:base -- --watch --growl",
    "test": "nyc npm run test:base -- \"tests/integrations/*.js\" --timeout 60000",
    "test:base": "mocha \"tests/lib/**/*.js\" --reporter dot",
    "update": "node ./tools/update.js",
    "version": "npm run lint -- --fix && git add ."
  },
  "version": "5.2.3"
}

[jpickwell]

@davidpelayo, the v5.2.3 tag was created and published on 2019-06-24. The commit you refer to was created on 2019-07-08. They haven’t published a new version containing that commit.

[jtsom]

Almost a month later now, any chance this will be updated to support ESLint 6 sometime soon??

[kaechele]

Given that it seems to be only a matter of tagging a release and releases usually are made periodically, statistically the chance for seeing a release that contains the fix for this issue is increasingly likely.
Stochastically, given that we have seen a release of this project about once every month in the past, it is extremely likely that this will resolve itself within the next 4 weeks.

[alex-ut]

This has become a bit more urgent because eslint-utils, a dependency of eslint, has a known vulnerability in it which is fixed in the eslint version 6 suite. Please make a release of eslint-plugin-vue soon(er).

https://github.com/mysticatea/eslint-utils/security/advisories/GHSA-3gx7-xhv7-5mx3

[nysos3]

@mysticatea Any hope of a release soon? ❤️ (Especially seeing as you're the one to report the aforementioned vulnerability 👀)

[juhasev]

This is a show stopper for many packages out there. I may have to hold on upgrading because of this. Hopefully eslint-6 compatibility gets out soon!

[limeandcoconut]

Any movement on this? It's an issue

[thefoxie]

Been watching this issue for a long time and still nothing.

[thefoxie]

July: It has to be a matter of days
ESLint 6 compatibility in October be like:

[kaidjohnson]

fwiw, we've been using eslint 6 with eslint-plugin-vue for several months now without issue. The peerDependencies are up-to-date but not published to npm in 5.2.3 (sounds like it is included in 5.2.2, though).

Can someone who has rights either a) publish 5.2.4 with the update from #917 which seems to be in 5.2.2 but not 5.2.3 or b) provide some insight into what's holding this up?

[gluons]

Maybe they're waiting for mysticatea/vue-eslint-parser#54 to be resolved.

[jmoore914]

Am I understanding correctly that this was already committed and merged to master and just needs to be published to npm? Seems like a really strange thing not to publish it given that it is forcing everybody to use a package with a known vulnerability...

Plus it would be really cool to use the new TS features (optional chaining and null coalescing) that just dropped.

[fengerzh]

Vue 3.0 already released, we will use tslint, so this is not important.

[Morgul]

@fengerzh Just an FYI, tslint is being deprecated in favor of eslint: https://github.com/palantir/tslint/issues/4534.

Additionally, as typescript isn't the only way to write Vue (including Vue v3.0), I'd say this is still important.

[alex-ut]

@fengerzh The maintainer can't take all of five minutes to make a release to make a few dozen people happy and several apps around the world that much more secure? Believe me, if I had admin rights on the project, I'd be more than happy to fill in a couple <textarea>s and click a few <button>s to make this happen.

[fengerzh]

Well, look at the issue create time: July 3rd. And now it's October 8th. After 3 months, nothing happened. The last release of this project is: June 24th, last commit is 12 days ago. We all understand the project is open sourced and maintained by volunteers, but don't you think it's too long even for an open source project?

[aldarund]

vue 3 isnt even remotely released, its in pre alpha..

[ssorallen]

The maintainer can't take all of five minutes to make a release to make a few dozen people happy and several apps around the world that much more secure?

@alex-ut I too would like to see an update released, but these kinds of comments directed at people working on open source software for free are simply not helpful in the best case and cause burn out of maintainers in the worst case. We are not entitled to other people's free, unpaid time. Please be respectful and constructive or otherwise don't comment at all.

[alex-ut]

@ssorallen Look, I mean no disrespect. Honestly. I understand if people are busy. I'm not feeling entitled; I'm just asking. I saw that the maintainer had some activity on another project, so I pinged him/her there. I just find it curious that (s)he can make commits and comments elsewhere (in open source), but not at least spend a couple minutes dropping a comment here explaining why this project can't get a version released.

[poganytamas]

Please please

[michalsnik]

We just released eslint-plugin-vue@6, so you can finally upgrade to ESLint 6 and report if you encounter any problems while doing so. Shortly we'll follow up with updated vue-cli that ships ESLint 6 by default :)

I'm super sorry folks it took us so long to get this shipped, we certainly can do better than that and I'm the one to blame here. I was extremely consumed by the commercial project I'm working on where I'm a single FE dev and I had to step down from active OS contributions for a while to not get burned out.

Thank you for this comment @ssorallen! Can't appreciate this attitude enough 🥇

Notice: vue-eslint-parser still needs to be updated to officially support ESLint 6. However I just upgraded ESLint in my commercial project and it worked just fine.

[alex-ut]

I was extremely consumed by the commercial project I'm working on where I'm a single FE dev and I had to step down from active OS contributions for a while to not get burned out.

@michalsnik Totally understandable! Thank you for releasing, and thank you for talking about why it was delayed. It's appreciated.