Skip to content

security(MSDK-3377): resolve OSS vulnerabilities in sample app depend… #208

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
asadraza-usercentrics merged 4 commits into from
Apr 28, 2026
+2,346 −1,473
Merged

security(MSDK-3377): resolve OSS vulnerabilities in sample app depend… #208

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ccbbdc5
security(MSDK-3377): resolve OSS vulnerabilities in sample app depend…
Maximum21 Apr 23, 2026
d04767c
fix(MSDK-3377): address PR review findings in sample dependency fixes
asadraza-usercentrics Apr 23, 2026
f5b5a28
revert(MSDK-3377): restore check-requirements.sh Node requirement to …
asadraza-usercentrics Apr 23, 2026
3ce2af7
revert(MSDK-3377): restore noisy version changes
asadraza-usercentrics Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions sample/.eslintrc.js
View file
Open in desktop

This file was deleted.

28 changes: 28 additions & 0 deletions sample/eslint.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
const { FlatCompat } = require("@eslint/eslintrc");
const js = require("@eslint/js");
const typescriptEslint = require("@typescript-eslint/eslint-plugin");
const tsParser = require("@typescript-eslint/parser");

const compat = new FlatCompat({
baseDirectory: __dirname,
recommendedConfig: js.configs.recommended,
allConfig: js.configs.all
});

module.exports = [
...compat.extends("@react-native"),
{
files: ["**/*.ts", "**/*.tsx"],
languageOptions: {
parser: tsParser,
parserOptions: {
ecmaVersion: "latest",
sourceType: "module",
},
},
plugins: { "@typescript-eslint": typescriptEslint },
rules: {
"@typescript-eslint/no-unused-vars": "warn",
Copy link
Copy Markdown

@codeant-ai codeant-ai Bot May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The TypeScript-specific unused-variable rule is enabled, but the base JavaScript no-unused-vars rule is not turned off for the same files. When both run on .ts/.tsx, ESLint can report duplicate or incorrect unused-variable findings (and may fail lint if the base rule is configured as an error in the extended config). Disable the base rule in this TypeScript override when enabling the TypeScript version. [logic error]

Severity Level: Major ⚠️ 
- ⚠️ TypeScript linting reports duplicate unused-variable errors on symbols.
- ⚠️ CI lint step may fail on duplicated TS unused-vars.
Steps of Reproduction ✅ 
1. From `sample/package.json:5-8`, note the lint script `"lint": "eslint ."` which runs
ESLint over the entire `sample` project.

2. Open `sample/src/App.tsx:9-34` and temporarily add an unused variable inside the `App`
component (e.g., on a new line after 10: `const unused = 1;`).

3. In the `sample` directory, run `npm install` to install devDependencies (including
`eslint`, `@react-native/eslint-config`, `@typescript-eslint/*`) and then run `npm run
lint` to execute ESLint with the flat config in `sample/eslint.config.js:1-28`.

4. ESLint loads the base `@react-native` config via `...compat.extends("@react-native")`
at `sample/eslint.config.js:12-13`, which includes the core `no-unused-vars` rule, and
then applies the TypeScript override at lines 15-27 where
`@typescript-eslint/no-unused-vars` is enabled at line 25 without disabling the core
`no-unused-vars` rule; the unused variable in `App.tsx` is reported twice (once by
`no-unused-vars` from the base config and once by `@typescript-eslint/no-unused-vars` from
this override), and if the base rule is configured as an error upstream, the lint command
will fail even though the TypeScript-specific rule is only a warning.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** sample/eslint.config.js
**Line:** 25:25
**Comment:**
	*Logic Error: The TypeScript-specific unused-variable rule is enabled, but the base JavaScript `no-unused-vars` rule is not turned off for the same files. When both run on `.ts/.tsx`, ESLint can report duplicate or incorrect unused-variable findings (and may fail lint if the base rule is configured as an error in the extended config). Disable the base rule in this TypeScript override when enabling the TypeScript version.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎

},
},
Comment thread
asadraza-usercentrics marked this conversation as resolved.
Comment thread
asadraza-usercentrics marked this conversation as resolved.
];
Loading
Loading