mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-12 06:48:55 +00:00
ignacionelson
9192779ee4
Four unrelated one-liners, each already written down and none of them worth a branch of its own. The lock was still pinned to the community package's previous commit, which is the one before it started shipping its own sixteen catalogues. The mechanism that carries a package's translations to the browser landed here last week; without this bump the release would have shipped that mechanism with nothing to carry, and the Custom Assets screen would have stayed half-English in every language. The stock `local` disk had `serve` left on. Nothing in this application writes to it, so the framework's /storage route was a door with nothing behind it — but it was still a door, and closing it costs one word. nginx evaluated `\.php$` before `/protected-files/`, so a protected path ending in .php would have reached the PHP handler instead of streaming under the sandbox headers that block sets. Not reachable on a default install — the upload allowlist refuses php and X-Accel paths are UUIDs — but the guarantee read stronger than it was. `^~` makes it true. And `.release-build` is now ignored by eslint, so linting after building a zip stops walking the vendored minified JS inside it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
51 lines
1.7 KiB
JavaScript
51 lines
1.7 KiB
JavaScript
import js from '@eslint/js';
|
|
import prettier from 'eslint-config-prettier';
|
|
import react from 'eslint-plugin-react';
|
|
import reactHooks from 'eslint-plugin-react-hooks';
|
|
import globals from 'globals';
|
|
import typescript from 'typescript-eslint';
|
|
|
|
/** @type {import('eslint').Linter.Config[]} */
|
|
export default [
|
|
js.configs.recommended,
|
|
...typescript.configs.recommended,
|
|
{
|
|
...react.configs.flat.recommended,
|
|
...react.configs.flat['jsx-runtime'], // Required for React 17+
|
|
languageOptions: {
|
|
globals: {
|
|
...globals.browser,
|
|
},
|
|
},
|
|
rules: {
|
|
'react/react-in-jsx-scope': 'off',
|
|
'react/prop-types': 'off',
|
|
'react/no-unescaped-entities': 'off',
|
|
},
|
|
settings: {
|
|
react: {
|
|
version: 'detect',
|
|
},
|
|
},
|
|
},
|
|
{
|
|
plugins: {
|
|
'react-hooks': reactHooks,
|
|
},
|
|
rules: {
|
|
'react-hooks/rules-of-hooks': 'error',
|
|
'react-hooks/exhaustive-deps': 'warn',
|
|
},
|
|
},
|
|
{
|
|
// Maintainer tooling scripts (*.cjs) are plain Node, not app
|
|
// source — they don't run in the browser and use Node globals
|
|
// (require, process, __dirname) the app's ruleset forbids.
|
|
// `.release-build` is where build-release.sh assembles a zip: a full
|
|
// copy of the app plus vendored, minified JS. It is gitignored, so
|
|
// linting it only ever means `--fix` rewriting artifacts nobody reads.
|
|
ignores: ['vendor', 'node_modules', 'public', 'bootstrap/ssr', 'tailwind.config.js', '.claude', 'packages', '.release-build'],
|
|
},
|
|
prettier, // Turn off all rules that might conflict with Prettier
|
|
];
|