Repository navigation
chore(deps): update dependency npm:secretlint to v14 - #115
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
✅MegaLinter analysis: Success
See detailed reports in MegaLinter artifacts
|
✅MegaLinter analysis: Success
See detailed reports in MegaLinter artifacts
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
13.1.0→14.0.0Release Notes
secretlint/secretlint (npm:secretlint)
v14.0.0Compare Source
Highlights
Secretlint v14 is faster, has fewer dependencies, and works without any setup.
secretlint.npm install secretlintis all you need.Upgrading from v13? Read the migration guide.
Performance
secretlint "**/*"Recommended preset, median wall time, Node.js 24.22, 4 vCPU Linux. Both versions report the same 37 messages on vscode.
Secretlint is still JavaScript. It was not rewritten in Rust or another language, and it uses no native module or WebAssembly. So
@secretlint/coreand the recommended rules still run in browsers as they are, and a new browser test (Playwright + Chromium) checks this on every change (#1803, #1804). The worker threads below are used only by the Node.js CLI and@secretlint/node.In short: the single thread was made fast first. Then worker threads were added only to read files and look for keywords, and the rules run on the main thread for the few files that have a keyword. For the details, read "Looking for keywords on several threads" in the design document.
What made it faster:
enableIDScanRuleis off (#1819).You can see where the time goes with
secretlint --profile "**/*". It now prints a summary by phase, rule, pattern, and file (#1820).The official rules are built in
The official rules and presets moved into
@secretlint/core(#1798, #1832).Why: each official rule was its own npm package. Publishing a new package needs manual setup on npm (trusted publishing for each package), and every release published more than 30 rule packages. This made a release error-prone and made adding a new rule expensive. Now a new rule is a file in
@secretlint/core, and the rules always have the same version as Secretlint..secretlintrc.jsonfiles keep working.@secretlint/core. An old rule package that is still installed is not loaded, and you can remove it frompackage.json.@secretlint/secretlint-rule-no-dotenv,-no-homedir,-no-k8s-kind-secret, and-secp256k1-privatekeyare still separate packages.Third-party runtime dependencies of
secretlintwent from 69 packages (v13.1.0 with the recommend preset) to 16 (#1809, #1810, #1813, #1814).Zero config
When no configuration file is found, Secretlint runs the recommended rules instead of failing (#1835). The recommended rules are designed to report very few false positives, so running them by default is safe.
secretlint --initalways writes the recommended preset (#1833).npx secretlint "**/*"@secretlint/quick-startis no longer needed: usenpx secretlint "**/*"instead.Declarative rules
A rule can be data:
patternswithkeywords, instead of acreate()function (#1794). The core runs the patterns only on the files that contain a keyword.@secretlint/secretlint-rule-patternreads its user patterns the same way, so a config with your own patterns is fast too (#1826). See Creating a rule.Breaking Changes
Most users can upgrade without changing anything. Update
secretlintto v14, and your.secretlintrckeeps working with the same rule ids. Removing the rule packages that are no longer used is recommended, but not required.See the migration guide for details and examples.
Recommended: remove the rule packages
The packages are gone, but their rule ids stay. Keep using the same ids in
.secretlintrc.json. This configuration works in v14 without installing any rule package:{ "rules": [ { "id": "@secretlint/secretlint-rule-preset-recommend" } ] }The official rules and presets are bundled in
secretlint, so the rule packages that you installed are no longer used. Remove them to avoid installing packages that are not used:If you installed other official rule packages, this command removes all of them (a package that is not installed is skipped):
pnpm (
pnpm remove) and Yarn stop with an error when a package is not installed, so pass only the packages that are in yourpackage.json.The official rule packages and presets are not published from v14. A rule package that is still installed is not loaded: the rule id always uses the rule bundled in
secretlint.For users of the command line
--secretlintrc <path>names exactly one file from the current directory. It no longer searches the parent directories or adds an extension.--secretlintignore <path>is a path from the current directory, and it is read in addition to.secretlintignore..gitignore,.secretlintignore, and--secretlintignoreare combined. A file is ignored if any of them ignores it, and a!rule only re-includes within the same kind of file. Ignore rules are matched like Git. To lint the files that.gitignoreignores, use--no-gitignore.enableIDScanRulemust be a boolean (true, not"true").--profileprints a summary instead of the lint results.For developers (API, formatters, and rules)
--format jsonno longer containsourceContent. Formatters getgetSource(filePath).configFilePathofloadConfig()/loadConfigDescriptor()isstring | undefined."all"is removed fromSecretLintRuleContentType, andcreateis optional inSecretLintRuleCreator.@secretlint/secretlint-rule-*imports it from@secretlint/core/builtin/rules/<name>.What's Changed
Breaking Changes
Features
Bug Fixes
profileoption to createEngine by @azu in #1784Performance
whento a pattern, and do not run the ID scan patterns of the aws rule by default by @azu in #1819Documentation
Refactoring
Testing
Maintenance
CI
Dependency Updates
Other Changes
New Contributors
Full Changelog: secretlint/secretlint@v13.1.0...v14.0.0
Generated by Claude Code
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.