Build: Switch from JSHint to ESLint

Motivated by fixing npm-audit warning for minimatch 3.0
(fixed in minimatch 3.1) due to hardcoded version in JSHint.

https://nvd.nist.gov/vuln/detail/CVE-2026-26996
https://nvd.nist.gov/vuln/detail/CVE-2026-27903
https://nvd.nist.gov/vuln/detail/CVE-2026-27904

* Match main Grunt repo which moved to ESLint years ago

  This matches what gruntjs/grunt uses.

  Ref gruntjs/grunt#1533

* Fix ESLint output noise by overriding eslint-plugin-pabigot until
  the upstream config is updated accordingly.

  Ref markelog/eslint-config-grunt#2

Author: Krinkle

.eslintrc.json

@@ -0,0 +1,13 @@
+{
+    "root": true,
+    "extends": "grunt",
+    "parserOptions": {
+        "ecmaVersion": 2017
+    },
+    "env": {
+        "es2017": true
+    },
+    "rules": {
+        "one-var": ["error", "never"]
+    }
+}

.github/workflows/test.yml

@@ -20,17 +20,16 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-        # Pin to 22.4 because of https://github.com/npm/cli/issues/7657
-        node: [18, 20, "22.4"]
+        node: [18, 20, 24]
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
 

.jshintrc

@@ -12,16 +12,6 @@ module.exports = function(grunt) {
 
   // Project configuration.
   grunt.initConfig({
-    jshint: {
-      all: [
-        'Gruntfile.js',
-        'tasks/**/*.js'
-      ],
-      options: {
-        jshintrc: '.jshintrc'
-      }
-    },
-
     // Create a local web server for testing http:// URIs.
     connect: {
       rootServer: {
@@ -254,13 +244,12 @@ module.exports = function(grunt) {
   grunt.loadTasks('tasks');
 
   // These plugins provide necessary tasks.
-  grunt.loadNpmTasks('grunt-contrib-jshint');
   grunt.loadNpmTasks('grunt-contrib-connect');
   grunt.loadNpmTasks('grunt-contrib-internal');
   grunt.loadNpmTasks('grunt-shell');
 
   // Whenever the "test" task is run, run some basic tests.
-  grunt.registerTask('test', ['jshint', 'connect', 'qunit', 'shell', 'really-test']);
+  grunt.registerTask('test', ['connect', 'qunit', 'shell', 'really-test']);
 
   // By default, lint and run all tests.
   grunt.registerTask('default', ['test', 'contrib-core', 'contrib-ci:skipIfExists']);

Gruntfile.js

@@ -6,7 +6,7 @@
  * Licensed under the MIT license.
  */
 
-/* global QUnit:true */
+/* eslint-env qunit, browser */
 (function() {
   'use strict';
 
@@ -56,14 +56,14 @@
     // In that case, replace actual and expected
     var errors = obj.errors;
     if (!canBeJSONStringified(errors)) {
-      errors = obj.errors.map(function (error) {
+      errors = obj.errors.map(function(error) {
         return {
           passed: error.passed,
           message: error.message,
           stack: error.stack,
           actual: replaceIfCannotBeJSONStringified(error.actual),
           expected: replaceIfCannotBeJSONStringified(error.expected)
-        }
+        };
       });
     }
 

chrome/bridge.js

@@ -13,18 +13,23 @@
   },
   "main": "tasks/qunit.js",
   "scripts": {
-    "test": "grunt test --stack"
+    "test": "eslint . && grunt test --stack"
   },
   "dependencies": {
     "eventemitter2": "^6.4.9",
     "puppeteer": "^22.0.0"
   },
+  "overrides": {
+    "eslint-plugin-pabigot": "^1.1.0"
+  },
   "devDependencies": {
     "difflet": "^1.0.1",
+    "eslint-config-grunt": "^2.0.1",
+    "eslint-plugin-pabigot": "^1.1.0",
+    "eslint": "^8.57.0",
     "grunt": "^1.6.1",
-    "grunt-contrib-connect": "^4.0.0",
+    "grunt-contrib-connect": "^5.0.0",
     "grunt-contrib-internal": "^9.0.0",
-    "grunt-contrib-jshint": "^3.2.0",
     "grunt-shell": "^4.0.0",
     "qunit": "^2.21.0"
   },

package.json

@@ -21,13 +21,13 @@ var Promise = global.Promise;
 // Shared functions
 
 // Allow an error message to retain its color when split across multiple lines.
-function formatMessage (message) {
+function formatMessage(message) {
   var str = String(message);
   if (typeof message === 'object' && /^\[object .*\]$/.test(str)) {
     // try to use the JSON as a better string representation
     try {
       str = JSON.stringify(message, null, 2);
-    } catch ( _ ) {
+    } catch (_) {
     }
   }
   return String(str).split('\n')
@@ -38,7 +38,7 @@ function formatMessage (message) {
 }
 
 
-function createRunEnd () {
+function createRunEnd() {
   return {
     status: 'passed',
     testCounts: {
@@ -80,7 +80,7 @@ function generateMessage(combined) {
 }
 
 // Copied from QUnit source code
-function generateHash (module) {
+function generateHash(module) {
   var hex;
   var i = 0;
   var hash = 0;
@@ -104,7 +104,7 @@ function generateHash (module) {
 }
 
 function getPath(url) {
-  if (url.substr( 0, 7 ) === 'http://' || url.substr( 0, 8 ) === 'https://') {
+  if (url.substr(0, 7) === 'http://' || url.substr(0, 8) === 'https://') {
     return url;
   }
 
@@ -127,7 +127,7 @@ module.exports = function(grunt) {
   var asset = path.join.bind(null, __dirname, '..');
 
   // If options.force then log an error, otherwise exit with a warning
-  function warnUnlessForced (message) {
+  function warnUnlessForced(message) {
     if (options && options.force) {
       grunt.log.error(message);
     } else {
@@ -231,7 +231,7 @@ module.exports = function(grunt) {
     combinedRunEnd.status = 'failed';
   });
 
-  eventBus.on('qunit.on.error', function (err) {
+  eventBus.on('qunit.on.error', function(err) {
     // It is the responsibility of QUnit to ensure a run is marked as failure
     // if there are (unexpected) messages received from window.onerror.
     //
@@ -250,7 +250,7 @@ module.exports = function(grunt) {
     grunt.event.emit('qunit.error.onError', err);
   });
 
-  eventBus.on('error.onError', function (msg) {
+  eventBus.on('error.onError', function(msg) {
     // This is important in addition to `QUnit.on('error')` to catch uncaught
     // errors that happen before the bridge is in effect (which in practice
     // will happen at DOMContentLoaded, after qunit.js and test files have done
@@ -296,7 +296,7 @@ module.exports = function(grunt) {
     // Read the content of the specified bridge files
     var bridgeFiles = Array.isArray(options.inject) ? options.inject : [options.inject];
     var bridgContents = [
-      "__grunt_contrib_qunit_timeout__ = " + JSON.stringify( options.timeout ) + ";"
+      '__grunt_contrib_qunit_timeout__ = ' + JSON.stringify(options.timeout) + ';'
     ];
 
     for (var i = 0; i < bridgeFiles.length; i++) {
@@ -329,7 +329,7 @@ module.exports = function(grunt) {
       done(success);
     }
 
-    function appendToUrls (queryParam, value) {
+    function appendToUrls(queryParam, value) {
       // Append the query param to all urls
       urls = urls.map(function(testUrl) {
         var parsed = url.parse(testUrl, true);
@@ -415,7 +415,14 @@ module.exports = function(grunt) {
         // Tell the client that when DOMContentLoaded fires, it needs to tell this
         // script to inject the bridge. This should ensure that the bridge gets
         // injected before any other DOMContentLoaded or window.load event handler.
-        page.evaluateOnNewDocument('if (window.QUnit) {\n' + bridgContents.join(";") + '\n} else {\n' + 'document.addEventListener("DOMContentLoaded", function() {\n' + bridgContents.join(";") + '\n});\n}\n');
+        page.evaluateOnNewDocument(
+          'if (window.QUnit) {\n' +
+            bridgContents.join(';') +
+            '\n} else {\n' +
+            'document.addEventListener("DOMContentLoaded", function() {\n' +
+            bridgContents.join(';') +
+            '\n});\n}\n'
+        );
 
         for (const url of urls) {
           // Reset current module.
@@ -453,7 +460,7 @@ module.exports = function(grunt) {
       })
       .catch(function(err) {
         // If anything goes wrong, terminate the grunt task
-        grunt.log.error("There was an error with headless chrome");
+        grunt.log.error('There was an error with headless chrome');
         grunt.fail.fatal(err);
         finishTask(false);
       });

tasks/qunit.js

@@ -0,0 +1,7 @@
+{
+    "extends": "../.eslintrc.json",
+    "env": {
+        "browser": true,
+        "qunit": true
+    }
+}

test/.eslintrc.json

@@ -9,6 +9,7 @@ QUnit.on('testEnd', function(test) {
 
 QUnit.todo('global pollution', function(assert) {
   window.myPollution = true;
+  // eslint-disable-next-line no-undef
   assert.true(myPollution, 'nasty pollution');
   // We expect QUnit to add an error to the end of this test
 });

test/qunit_noglobals.js

@@ -1,7 +1,7 @@
 QUnit.module('grunt-contrib-qunit timeout');
 
 QUnit.test('last forever', function(assert) {
-  var done = assert.async();
+  assert.async();
 
-  assert.ok( true );
+  assert.ok(true);
 });