fix(deps): remove unused @quasar/app-vite and bump vite to 8.1.4#265
Open
rlorenzo wants to merge 1 commit into
Open
fix(deps): remove unused @quasar/app-vite and bump vite to 8.1.4#265rlorenzo wants to merge 1 commit into
rlorenzo wants to merge 1 commit into
Conversation
Bundle ReportChanges will increase total bundle size by 2.2kB (0.1%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: viper-frontend-esmAssets Changed:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #265 +/- ##
==========================================
- Coverage 45.39% 45.38% -0.01%
==========================================
Files 916 916
Lines 52784 52787 +3
Branches 5005 5005
==========================================
Hits 23960 23960
- Misses 28196 28199 +3
Partials 628 628
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
- Drop @quasar/app-vite: only used for its ESLint ignore-glob config and as the sole requirer of esbuild plus the sass-embedded -> immutable chain. Removing it drops the high-severity immutable DoS and esbuild advisories from the VueApp production tree. - Inline the Quasar ESLint ignore globs into eslint.config.mjs so linting no longer imports from @quasar/app-vite. - Update vite 8.1.0 -> 8.1.4.
rlorenzo
force-pushed
the
fix/vueapp-audit-esbuild-immutable
branch
from
July 23, 2026 05:55
ee0896a to
0a65ec1
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
VueApp/eslint.config.mjs:23
- The PR description says the only functional use of
@quasar/app-vitewas to supply ESLint ignore globs, but this change also removes the Quasar recommended ESLint config (...quasarEslint.configs.recommended()). If dropping Quasar-specific rules is intentional, the PR description should be updated to reflect that; otherwise, consider replacing those recommended rules via an alternative Quasar ESLint package/config so lint coverage doesn’t regress when removing@quasar/app-vite.
// ESLint recommended rules
eslint.configs.recommended,
// Vue strongly recommended rules
...pluginVue.configs["flat/strongly-recommended"],
Contributor
Author
|
@ // node_modules/@quasar/app-vite/exports/eslint/eslint.js
const ignoreList = ["dist/*", "src-capacitor/*", "src-cordova/*", ".quasar/*", "quasar.config.*.temporary.compiled*"]
export default {
configs: {
recommended() {
return [{ ignores: ignoreList }]
}
}
}So there are no Quasar-specific rules to lose. Those exact ignore globs are inlined into the |
bniedzie
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Clears the high-severity findings in the VueApp production dependency audit (
npm audit --prefix VueApp --omit=dev --audit-level=high). That audit step does not block deployment; it was marking the JenkinsViper .NETdeploy step as unstable.@quasar/app-vite(devDependency). The build does not use it (the build uses@quasar/vite-pluginvia a hand-rolledvite.config.ts, there is noquasar.config, and the npm scripts callvite/vite builddirectly). Its only real use was supplying ESLint ignore globs via@quasar/app-vite/eslint; those are inlined intoeslint.config.mjsin this PR. It was also the sole hard requirer ofesbuild, and it pulled in thesass-embedded -> immutablechain plus a large unused subtree (@quasar/ssl-certificate,@peculiar/*,selfsigned, ...). Dropping it prunes esbuild, immutable, sass, sass-embedded entirely, clearing the high-severityimmutableDoS advisories and the low-severityesbuildadvisory from the production tree.eslint.config.mjsso linting no longer imports from@quasar/app-vite.vite8.1.0 -> 8.1.4.Why removal instead of version overrides
immutableandesbuildare transitive-only and reachable only through@quasar/app-vite. Since the build does not use that package, removing it fixes both findings at the source rather than pinning packages we do not ship. Vite 8 already uses rolldown + oxc for bundling and minification, so esbuild was vestigial.Verification
npm audit --prefix VueApp --omit=dev --audit-level=high: found 0 vulnerabilitiesnpm run build(VueApp): passes (type-check + rolldown/oxc)npm run test:run(VueApp): 55 files, 799 tests passnpm run lint(VueApp): ESLint config loads without@quasar/app-vite.scss/.sasssources exist, so removing the Sass compiler is safe (Quasar uses precompiled CSS)Note: the large
package-lock.jsondelta is entirely the pruning of the@quasar/app-vitesubtree.