chore: replace pnpm, node --run, and vite-node with nub by Rel1cx · Pull Request #1919 · Rel1cx/eslint-react

Rel1cx · 2026-07-21T15:27:04Z

Update "[ ]" to "[x]" to check a box

What kind of change does this PR introduce?

Check at least one. If you are introducing a new binding, you must reference an issue where this binding has been proposed, discussed and approved by the maintainers.

Does this PR introduce a breaking change?

If yes, please describe the impact and migration path for existing applications in an attached issue.

Yes, and the changes were approved in issue #___
No

Checklist

When resolving issues, they are referenced in the PR's title (e.g fix: remove a typo, closes #___, #___)
I have added a convincing reason for adding this feature, if necessary

Other information

Replace pnpm, node --run, and vite-node with nub across the repo:

Scripts: node --run X → nub run X; vite-node ./scripts/*.ts → nub ./scripts/*.ts (nub runs TS natively and resolves the repo's #/ tsconfig path aliases, so -c vitest.config.ts is no longer needed); pnpm -F ... run / pnpm m -F ... run → nub run --filter ...; pnpm m exec sort-package-json → nub exec sort-package-json with explicit workspace globs.
Dependencies: drop the vite-node devDependency and the "packageManager": "pnpm@..." pin; pnpm-lock.yaml regenerated via nub install (still lockfileVersion: 9.0, nub round-trips the pnpm format — the diff is mostly nub's key ordering and peer-suffix style).
Workflows: swap pnpm/action-setup for nubjs/setup-nub@v0; use nub install --frozen-lockfile, nub run, nub publish, and nub pack throughout CI. actions/setup-node is kept for the Node 22/24/26 test matrix — nub adopts the PATH Node since engines.node is a range.
nx.json: set "cli": { "packageManager": "npm" }. nx's run-script executor shells package scripts out through the detected package manager (pnpm run <script>), and nx only supports npm/yarn/pnpm/bun; npm ships with Node and does not verify the install layout, so it works with nub-installed node_modules.

pnpm-lock.yaml and pnpm-workspace.yaml are kept on purpose: nub infers the pnpm incumbent from them and reads/writes the pnpm format. Historical changelogs and release notes are untouched.

Verified locally with nub v0.4.13: nub install, nub run build, format:check, check:rules, lint:es (0 errors), lint:text, lint:ts, lint:publish, lint:examples, sort:package-json (no diff), update:all (no diff), and the full test suite (116 files, 4303 tests passed).

- package.json scripts: node --run -> nub run, vite-node -> nub, pnpm run/exec -> nub run/nub exec with --filter and explicit globs - drop vite-node devDependency and the pnpm packageManager pin - workflows: swap pnpm/action-setup for nubjs/setup-nub, use nub install/run/publish/pack throughout CI - nx.json: set cli.packageManager to npm since nx run-script shells out through the detected package manager - regenerate pnpm-lock.yaml via nub install

vercel · 2026-07-21T15:27:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eslint-react	Error		Jul 21, 2026 4:01pm

socket-security · 2026-07-21T15:27:54Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@typescript-eslint/parser@8.65.0
	typescript-eslint@8.65.0
	@typescript-eslint/rule-tester@8.65.0
	@typescript-eslint/type-utils@8.65.0
	@typescript-eslint/types@8.65.0
	import-integrity-lint@1.2.0
	@typescript-eslint/utils@8.65.0
	@typescript-eslint/scope-manager@8.65.0
	@typescript-eslint/typescript-estree@8.65.0
	eslint-plugin-jsdoc@63.2.0
	tsdown@0.22.12
	postcss@8.5.21

View full report

socket-security · 2026-07-21T15:27:56Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `eslint-plugin-jsdoc` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .pkgs/configs/package.json → `npm/eslint-plugin-jsdoc@63.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-jsdoc@63.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copilot

Pull request overview

This PR migrates the repo’s script execution, workspace filtering, and CI workflows from pnpm, node --run, and vite-node to nub, aiming to standardize local/CI commands and remove the vite-node dependency.

Changes:

Updated root/package-level scripts (including publish flows) to use nub run, nub exec, and direct nub ./scripts/*.ts execution.
Swapped GitHub Actions workflows from pnpm/action-setup to nubjs/setup-nub and replaced install/run steps with nub.
Adjusted Nx CLI package manager setting and updated docs/checklists to reflect nub commands.

Reviewed changes

Copilot reviewed 28 out of 29 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
scripts/90-scaffold-rule.ts	Updates scaffold instructions/output to reference `nub` usage.
package.json	Replaces root scripts with `nub` equivalents and removes `vite-node` devDependency / pnpm pin.
nx.json	Sets Nx CLI package manager to `npm` to keep Nx script execution working with nub-installed deps.
docs/rule-rename-checklist.md	Updates checklist commands from `pnpm` to `nub` (`exec` / `install --filter`).
docs/rule-feature-system.md	Updates documentation references from `node --run` to `nub run`.
.pkgs/testkit/package.json	Updates publish script to use `nub run`.
.pkgs/samples/package.json	Updates publish script to use `nub run`.
.pkgs/eff/package.json	Updates publish script to use `nub run`.
plugins/eslint-plugin/package.json	Updates publish script to use `nub run`.
plugins/eslint-plugin-react-x/package.json	Updates publish script to use `nub run`.
plugins/eslint-plugin-react-web-api/package.json	Updates publish script to use `nub run`.
plugins/eslint-plugin-react-rsc/package.json	Updates publish script to use `nub run`.
plugins/eslint-plugin-react-naming-convention/package.json	Updates publish script to use `nub run`.
plugins/eslint-plugin-react-jsx/package.json	Updates publish script to use `nub run`.
plugins/eslint-plugin-react-dom/package.json	Updates publish script to use `nub run`.
plugins/eslint-plugin-react-debug/package.json	Updates publish script to use `nub run`.
packages/var/package.json	Updates publish script to use `nub run`.
packages/shared/package.json	Updates publish script to use `nub run`.
packages/kit/package.json	Updates publish script to use `nub run`.
packages/jsx/package.json	Updates publish script to use `nub run`.
packages/eslint/package.json	Updates publish script to use `nub run`.
packages/core/package.json	Updates publish script to use `nub run`.
packages/ast/package.json	Updates publish script to use `nub run`.
.github/workflows/test.yml	Migrates CI test workflow to `nub install` / `nub run`.
.github/workflows/check.yml	Migrates CI check workflow to `nub install` / `nub run`.
.github/workflows/release.yml	Migrates release workflow to `nub` and updates pack step.
.github/workflows/publish.yml	Migrates publish workflow to `nub` and updates publish invocation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    "lint:website": "nub run --filter \"./apps/website\" lint",
+    "prepare": "nub run update:all && nub run build",
+    "scaffold:rule": "nub ./scripts/90-scaffold-rule.ts",
+    "sort:package-json": "nub exec sort-package-json -q \".pkgs/*/package.json\" \"apps/*/package.json\" \"packages/*/package.json\" \"plugins/*/package.json\" \"examples/*/package.json\" && dprint fmt",


+      - name: Setup nub
+        uses: nubjs/setup-nub@v0


+      - name: Setup nub
+        uses: nubjs/setup-nub@v0


+      - name: Setup nub
+        uses: nubjs/setup-nub@v0


+      - name: Setup nub
+        uses: nubjs/setup-nub@v0


          if git log -1 --pretty=%B | grep "^release: [0-9]\+\.[0-9]\+\.[0-9]\+$";
          then
-            pnpm --filter "./packages/*" --filter "./plugins/*" publish --provenance --access public
+            nub --filter "./packages/*" --filter "./plugins/*" publish --provenance --access public


          elif git log -1 --pretty=%B | grep "^release: [0-9]\+\.[0-9]\+\.[0-9]\+-rc\.[0-9]\+$";
          then
-            pnpm --filter "./packages/*" --filter "./plugins/*" publish --provenance --access public --tag rc --no-git-checks
+            nub --filter "./packages/*" --filter "./plugins/*" publish --provenance --access public --tag rc --no-git-checks


          elif git log -1 --pretty=%B | grep "^release: [0-9]\+\.[0-9]\+\.[0-9]\+-beta\.[0-9]\+$";
          then
-            pnpm --filter "./packages/*" --filter "./plugins/*" publish --provenance --access public --tag beta --no-git-checks
+            nub --filter "./packages/*" --filter "./plugins/*" publish --provenance --access public --tag beta --no-git-checks


…ands

The nub-based install/run/publish flow from #1919 is rolled back: CI workflows use pnpm/action-setup and node --run again, package.json restores "packageManager": "pnpm" and the pnpm/node --run scripts, nx.json drops the npm cli override, and apps/website/vercel.json now uses pnpm for install and build on Vercel. @nubjs/nub stays as a devDependency but only runs scripts/*.ts, replacing vite-node (nub resolves tsconfig.json#paths natively, so the -c vitest.config.ts flag is no longer needed). Also bumps typescript-eslint to 8.65, tsdown to 0.22.12, eslint-plugin-jsdoc to 63.2, import-integrity-lint to 1.2 and postcss to 8.5.20 across the workspace.

@nubjs/nub stays as a devDependency but only runs scripts/*.ts, replacing vite-node (nub resolves tsconfig.json#paths natively, so the -c vitest.config.ts flag is no longer needed). Also bumps typescript-eslint to 8.65, tsdown to 0.22.12, eslint-plugin-jsdoc to 63.2, import-integrity-lint to 1.2 and postcss to 8.5.20 across the workspace.

Rel1cx requested a review from Copilot July 21, 2026 15:28

Copilot started reviewing on behalf of Rel1cx July 21, 2026 15:29 View session

chore: pin nubjs/setup-nub action to commit hash

a6b9ba7

vercel Bot temporarily deployed to Preview July 21, 2026 15:30 Inactive

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Rel1cx force-pushed the chore/migrate-to-nub branch from 4d61ad0 to 0854758 Compare July 21, 2026 15:37

vercel Bot temporarily deployed to Preview July 21, 2026 15:40 Inactive

chore(website): add vercel.json with nub-based install and build comm…

bb81913

…ands

Rel1cx force-pushed the chore/migrate-to-nub branch from 0854758 to bb81913 Compare July 21, 2026 16:01

Rel1cx merged commit 0dc5bf2 into main Jul 21, 2026
7 of 11 checks passed

vercel Bot temporarily deployed to Preview July 21, 2026 16:01 Inactive

Rel1cx deleted the chore/migrate-to-nub branch July 21, 2026 16:01

Rel1cx added a commit that referenced this pull request Jul 21, 2026

chore: replace pnpm, node --run, and vite-node with nub (#1919)

284d70d

Navigation Menu

Uh oh!

chore: replace pnpm, node --run, and vite-node with nub - #1919

chore: replace pnpm, node --run, and vite-node with nub#1919
Rel1cx merged 3 commits into
mainfrom
chore/migrate-to-nub

Rel1cx commented Jul 21, 2026

Uh oh!

vercel Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Rel1cx commented Jul 21, 2026

What kind of change does this PR introduce?

Does this PR introduce a breaking change?

Checklist

Other information

Uh oh!

vercel Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Jul 21, 2026 •

edited

Loading

socket-security Bot commented Jul 21, 2026 •

edited

Loading

socket-security Bot commented Jul 21, 2026 •

edited

Loading