feat!: flat-config ESLint 10 rewrite with JS and TypeScript entries (8.0.0)

.changeset/config.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "fixed": [
+    [
+      "@cospired/eslint-config-base",
+      "@cospired/eslint-config-typescript",
+      "@cospired/eslint-config-react",
+      "@cospired/eslint-config-react-typescript"
+    ]
+  ]
+}

.changeset/flat-config-rewrite.md

@@ -0,0 +1,21 @@
+---
+'@cospired/eslint-config-base': major
+'@cospired/eslint-config-typescript': major
+'@cospired/eslint-config-react': major
+'@cospired/eslint-config-react-typescript': major
+---
+
+Rewrite for ESLint 10 flat config, replacing airbnb and the hapi plugin.
+
+Four packages: `base` (JavaScript, plus `/node`), `typescript` (plus `/node`), `react` and `react-typescript`. `base` and `react` keep their names; `typescript` and `react-typescript` are new, so JavaScript-only projects no longer need the TypeScript peers. Every entry works with no options: `export { default } from '@cospired/eslint-config-typescript/node';` is a complete `eslint.config.js`.
+
+Migrating from 7.x:
+
+- **Flat config only, ESLint 10, Node `^22.13 || >=24`.** `.eslintrc` is gone; use `eslint.config.js`.
+- **No airbnb, no hapi.** The airbnb rules we kept are documented in the rule files (`src/rules/`); the rest are dropped. hapi `scope-start` cannot coexist with Prettier and `no-arrowception` is dropped. Blank lines before `return` and after declarations come from `@stylistic/padding-line-between-statements`.
+- **Every rule is configured** (on, or off with a reason) for ESLint, typescript-eslint, import-x, @stylistic, eslint-comments, todo-plz, react-hooks, react-refresh and formatjs. Each rule has a comment block with description, reasoning and link. Rules left off that you want can be turned on in your own config.
+- **No `warn` severities:** every rule is `error` or off.
+- **Peers changed:** `@hapi/eslint-plugin`, `eslint-plugin-import`, `eslint-plugin-eslint-comments`, `eslint-plugin-react` and `eslint-plugin-jsx-a11y` are no longer used. New: `eslint-plugin-import-x`, `@eslint-community/eslint-plugin-eslint-comments`, `eslint-plugin-todo-plz`, `@stylistic/eslint-plugin`, `typescript-eslint`, `eslint-import-resolver-typescript`, `eslint-plugin-react-hooks`, `eslint-plugin-react-refresh`, `eslint-plugin-formatjs`.
+- **React:** the `/hooks` export is gone (hooks rules are part of the default). jsx-a11y returns when the plugin supports ESLint 10.
+- **Type-aware linting:** source files are linted with type information through typescript-eslint's project service and must belong to a tsconfig. Tests, scripts and TypeScript files at the package root (bundler, test runner or ORM configs) are linted without type information because build tsconfigs usually exclude them; `typedTests: true` type-checks those too (they must then be in a tsconfig).
+- **Rules you will notice:** disable comments need `-- reason`; TODOs need a ticket (`#123`); imports are alphabetized; `no-console` allows only `warn`/`error`; `eqeqeq`, `no-shadow`, `no-nested-ternary`, `prefer-template` and `no-await-in-loop` are errors; TypeScript source files need explicit return types.

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Keeps the SHA-pinned actions in .github/workflows up to date.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,72 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: test (node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [22.13.0, 24, 26, latest]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm test
+      - run: npm run lint
+
+  peer-floors:
+    name: peer dependency floors
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: node scripts/peer-floors.js
+      - run: npm test
+
+  smoke:
+    name: packed tarballs work in a clean project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run smoke
+
+  publish-dry-run:
+    name: publish dry run (pending changesets applied)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          cache: npm
+          registry-url: https://registry.npmjs.org
+      - run: npm ci
+      - name: Apply pending changesets and dry-run publish
+        run: |
+          if [ -z "$(find .changeset -name '*.md' ! -name README.md)" ]; then
+            echo "No pending changesets: nothing to publish."
+            exit 0
+          fi
+          npx changeset version
+          npm publish --dry-run --workspaces --access public

.github/workflows/release.yml

@@ -0,0 +1,38 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write # npm provenance
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          cache: npm
+          registry-url: https://registry.npmjs.org
+      - run: npm ci
+      - run: npm test
+      - run: npm run lint
+      - uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        with:
+          version: npm run version
+          publish: npm run release
+          title: 'chore: version packages'
+          commit: 'chore: version packages'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'

.gitignore

@@ -1 +1,3 @@
 node_modules
+.DS_Store
+.superpowers

README.md

@@ -1,4 +1,28 @@
-[![Build Status](https://travis-ci.com/cospired/javascript.svg?branch=master)](https://travis-ci.com/cospired/javascript)
+# @cospired/javascript
 
-# javascript
-basic packages for JS development
+Slightly opinionated ESLint flat configs (ESLint 10) for JavaScript and TypeScript.
+
+| Package | Entries | For |
+|---|---|---|
+| [`@cospired/eslint-config-base`](packages/eslint-config-base) | `.`, `./node` | JavaScript, Node.js JavaScript |
+| [`@cospired/eslint-config-typescript`](packages/eslint-config-typescript) | `.`, `./node` | TypeScript (type-aware), Node.js TypeScript |
+| [`@cospired/eslint-config-react`](packages/eslint-config-react) | `.` | React JavaScript |
+| [`@cospired/eslint-config-react-typescript`](packages/eslint-config-react-typescript) | `.` | React TypeScript |
+
+Every entry works with no options: `export { default } from '@cospired/eslint-config-typescript/node';` is a complete `eslint.config.js`.
+
+Every rule is documented in the rule files under `packages/*/src/rules/`: a comment block with the description, the reasoning and a link.
+
+## Development
+
+```sh
+npm install
+npm test        # node:test over every package and the test helpers
+npm run lint    # the repo lints itself with its own config
+npm run smoke   # pack the packages, install them in a clean project, lint with one-line configs
+npx changeset   # describe a change for the next release
+```
+
+Releases are cut by the changesets GitHub Action on `main`.
+
+CI runs the tests on Node 22.13, 24, 26 and the latest release, again with every peer dependency at its minimum version, and the pack smoke test.

RELEASING.md

@@ -0,0 +1,18 @@
+# Releasing
+
+Releases are cut by the `Release` workflow (`.github/workflows/release.yml`) with changesets.
+
+## One-time setup
+
+1. Give the repo an npm credential that can publish to the `@cospired` scope, either:
+   - a repo secret `NPM_TOKEN` (npm automation token), or
+   - npm trusted publishing: on npmjs.com add this repo and the `release.yml` workflow as a trusted publisher for both packages (then no token is needed).
+2. Allow GitHub Actions to create pull requests (Settings, Actions, General, Workflow permissions).
+
+## Each release
+
+1. Describe the change with `npx changeset` (CI's "publish dry run" job applies pending changesets and dry-runs the publish on every push).
+2. Merge to `main`. The workflow opens a "chore: version packages" PR that bumps versions and changelogs.
+3. Merge that PR. The workflow publishes to npm with provenance and tags the release.
+
+`npm run smoke` packs both packages and lints a clean project with every entry; CI runs it too.

eslint.config.js

@@ -0,0 +1,17 @@
+import nodeJs from '@cospired/eslint-config-base/node';
+
+// The repo lints itself with the config it ships.
+export default [
+  ...nodeJs,
+  { ignores: ['**/fixtures/**', '.superpowers/**'] },
+  {
+    // Test helpers import the plugins they check; they are devDependencies of the repo.
+    files: ['test-utils/**'],
+    rules: { 'import-x/no-extraneous-dependencies': ['error', { devDependencies: true }] },
+  },
+  {
+    // Tests and scripts import the shared helpers through relative paths across package boundaries.
+    files: ['**/test/**', 'test-utils/**', 'scripts/**'],
+    rules: { 'import-x/no-relative-packages': 'off', 'no-await-in-loop': 'off' },
+  },
+];