[chaitanyapotti]

Motivation and Context

eslint-plugin-import 2.32.0 accepts ESLint only through version 9. That peer range made npm install ESLint 9.39.5. That release is no longer supported. ESLint 9 also pulled minimatch into the lockfile.

Jira Link

N/A

Description

Remove eslint-plugin-import and the import-js/no-extraneous-dependencies rule from @toruslabs/oxlint-config-typescript. The native Oxlint import plugin stays. Bump eslint-plugin-tsdoc to 0.5.4. The lockfile now resolves ESLint 10.14.0 for the remaining ESLint peers. The root package manager pin moves to npm 12.2.1, and oxlint-tailwindcss moves to 1.17.1.

How has this been tested?

• vp test packages/oxlint-config-typescript/index.test.ts (5 tests passed)
• vp lint on the changed TypeScript files
• vp fmt --check on the changed TypeScript files and the changeset

Screenshots (if appropriate)

N/A

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project. (run lint)
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

Note

Medium Risk
Consumers lose no-extraneous-dependencies enforcement from this preset; dependency resolution shifts away from ESLint 9, which affects anyone relying on the old lint behavior or lockfile ESLint version.

Overview
Removes eslint-plugin-import from @toruslabs/oxlint-config-typescript so installs no longer pull in unsupported ESLint 9 via that plugin’s peer range. The preset still uses Oxlint’s built-in import plugin; only the JS bridge plugin import-js and the import-js/no-extraneous-dependencies rule are gone, so dev-vs-prod dependency checks from that rule no longer run.

eslint-plugin-tsdoc is bumped to 0.5.4. Root tooling pins npm 12.2.1 and oxlint-tailwindcss ^1.17.1. Tests were updated to match the slimmer jsPlugins list and removed extraneous-deps expectations.

^{Reviewed by Cursor Bugbot for commit 873478c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​node@​24.13.6 ⏵ 24.19.2	+1		+1
	oxlint-tailwindcss@​1.17.0 ⏵ 1.17.1	+1			+1

View full report