Skip to content

chore: drop ESLint in favor of Biome#108

Open
kyscott18 wants to merge 5 commits into
chore/root-pnpm-workspacefrom
reopen/104-biome-only-lint
Open

chore: drop ESLint in favor of Biome#108
kyscott18 wants to merge 5 commits into
chore/root-pnpm-workspacefrom
reopen/104-biome-only-lint

Conversation

@kyscott18

Copy link
Copy Markdown
Contributor

Replacement for #104, which GitHub marked as merged into the #103 branch before the changes landed on main.\n\nStacked on #103 to keep this PR focused on removing ESLint in favor of Biome.

Next 16 removed the built-in ESLint integration (next lint), and ESLint
wasn't wired into CI or the build, so eslint-config-next's @next/next rules
weren't being enforced anyway. Biome (run in the CI lint job) owns linting +
formatting + import organization going forward.

- Remove the 'lint': 'eslint' script and the eslint / eslint-config-next
  devDependencies from frontend/package.json.
- Delete frontend/eslint.config.mjs.
- Drop 'eslint.enable' from .vscode/settings.json (Biome is the formatter).
- Update root pnpm-lock.yaml (removes eslint + 300 transitive deps).

Verified locally: frozen install, pnpm typecheck, and biome ci all pass.
@vercel

vercel Bot commented Jun 11, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
monode Skipped Skipped Jun 11, 2026 4:56pm

Request Review

@kyscott18 kyscott18 changed the base branch from chore/root-pnpm-workspace to main June 11, 2026 15:40
@greptile-apps

greptile-apps Bot commented Jun 11, 2026

Copy link
Copy Markdown

Greptile Summary

This PR removes ESLint from the frontend package and consolidates linting under Biome, which is already configured at the monorepo root. The lint script in frontend/package.json and all ESLint dependencies are dropped; the root-level biome check . script takes over linting responsibility for the entire workspace.

  • frontend/package.json: Removes eslint, eslint-config-next, and the lint: eslint script; linting is now handled by biome check . in the root package.json.
  • frontend/eslint.config.mjs: Deleted — ESLint configuration no longer needed.
  • .vscode/settings.json: Drops eslint.enable: true since the extension is no longer in use.
  • pnpm-lock.yaml: Removes all ESLint and Babel transitive dependencies (previously pulled in by eslint-config-next), and simplifies the resolved next peer-dependency string by removing @babel/core.

Confidence Score: 5/5

Safe to merge — this is a straightforward tooling swap with no production code changes.

All changes are confined to dev tooling: ESLint and its transitive Babel deps are removed, Biome (already present and configured at the monorepo root) takes over linting for the entire workspace. The lockfile correctly reflects the removal. No application logic is touched.

No files require special attention.

Important Files Changed

Filename Overview
frontend/package.json Removes eslint/eslint-config-next devDependencies and the lint script; root-level biome check takes over linting.
frontend/eslint.config.mjs File deleted — ESLint flat-config removed entirely as part of the Biome migration.
.vscode/settings.json Removes eslint.enable: true; all remaining settings already point to Biome.
pnpm-lock.yaml Lockfile updated: ESLint, eslint-config-next, and all Babel transitive deps removed; next peer resolution simplified (no @babel/core).

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    Dev([Developer])

    subgraph Before
        A["frontend/eslint.config.mjs"] --> B["eslint (v9)"]
        B --> C["frontend lint script"]
    end

    subgraph After
        D["biome.json (root)"] --> E["@biomejs/biome (v2.1.2)"]
        E --> F["root lint script: biome check ."]
        F --> G["Covers entire workspace"]
    end

    Dev -->|pnpm lint| F
Loading

Reviews (2): Last reviewed commit: "Merge branch 'main' into reopen/104-biom..." | Re-trigger Greptile

kyscott18 and others added 3 commits June 11, 2026 16:59
* fix(backend): resolve auto-fixable clippy lints

Addresses 6 of the 8 clippy findings surfaced by the new rust CI job:
- needless_return (server.rs)
- match_like_matches_macro (server.rs)
- ptr_arg: &Vec<T> -> &[T] (event_filter.rs)
- needless_borrow (event_filter.rs)
- manual_is_multiple_of (event_listener.rs)
- clone_on_copy (serializable_event.rs)

Remaining (require manual judgment, deferred): large_enum_variant
(server.rs), should_implement_trait for from_str (event_listener.rs).

* fix(backend): resolve non-auto-fixable clippy lints

- large_enum_variant: box the 640-byte Event variant of EventDataOrMetrics
  (Event(Box<EventData>)). Since From::from infers its parameter type from
  the argument (deref coercion does not apply), the match-site call passes
  &*event_data to select From<&EventData>; construction uses Box::new(..).
- should_implement_trait: rename inherent EventName::from_str -> from_name
  (and its single caller) so it no longer shadows std::str::FromStr::from_str.

* fix(backend): remove redundant u64 casts in client (unnecessary_cast)

Surfaced once the lib compiled clean: timestamp_ns is u64, so the
(u64 - u64) as u64 casts are redundant; drop the cast and parens.
* ci: unified frontend workflow (lint + typecheck + build)

* ci: add rust job (fmt + clippy + build)

* ci: run rust job in rust:1.91-slim container for libclang/bindgen parity

* fix(backend): resolve auto-fixable clippy lints

Addresses 6 of the 8 clippy findings surfaced by the new rust CI job:
- needless_return (server.rs)
- match_like_matches_macro (server.rs)
- ptr_arg: &Vec<T> -> &[T] (event_filter.rs)
- needless_borrow (event_filter.rs)
- manual_is_multiple_of (event_listener.rs)
- clone_on_copy (serializable_event.rs)

Remaining (require manual judgment, deferred): large_enum_variant
(server.rs), should_implement_trait for from_str (event_listener.rs).

* fix(backend): resolve non-auto-fixable clippy lints

- large_enum_variant: box the 640-byte Event variant of EventDataOrMetrics
  (Event(Box<EventData>)). Since From::from infers its parameter type from
  the argument (deref coercion does not apply), the match-site call passes
  &*event_data to select From<&EventData>; construction uses Box::new(..).
- should_implement_trait: rename inherent EventName::from_str -> from_name
  (and its single caller) so it no longer shadows std::str::FromStr::from_str.

* fix(backend): remove redundant u64 casts in client (unnecessary_cast)

Surfaced once the lib compiled clean: timestamp_ns is u64, so the
(u64 - u64) as u64 casts are redundant; drop the cast and parens.

---------

Co-authored-by: Camillebzd <bcamille99@gmail.com>
# Conflicts:
#	.github/workflows/ci.yml
#	frontend/package.json
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​types/​react@​19.2.7 ⏵ 19.2.16100 +110079 +196100
Updatednpm/​@​types/​node@​20.19.25 ⏵ 20.19.41100 +110081 +196100
Updatednpm/​tailwindcss@​4.1.17 ⏵ 4.3.0100 +110084 +198100
Updatednpm/​@​tailwindcss/​postcss@​4.1.17 ⏵ 4.3.0100 +110010098100

View full report

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.2.6npm/caniuse-lite@1.0.30001793

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001793. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.2.6npm/caniuse-lite@1.0.30001793

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001793. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.2.6npm/caniuse-lite@1.0.30001793

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001793. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/next@16.2.6npm/caniuse-lite@1.0.30001793

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001793. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@kyscott18 kyscott18 changed the base branch from main to chore/root-pnpm-workspace June 11, 2026 16:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant