Bump eslint from 9.39.2 to 10.8.1

[dependabot]

Bumps eslint from 9.39.2 to 10.8.1.

Release notes

Sourced from eslint's releases.

v10.8.1

Bug Fixes

• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
• 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
• 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
• 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
• 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

• 7d0cbf8 docs: Update README (GitHub Actions Bot)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
• 678c90b docs: Update README (GitHub Actions Bot)
• 8a10424 docs: Update README (GitHub Actions Bot)
• 69bb948 docs: Update README (GitHub Actions Bot)

Chores

• 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
• 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
• f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
• 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
• d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)
• 65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)
• 22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)
• 55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])
• 7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])
• eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)
• 60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)
• f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)
• d086293 test: add error locations to no-undef (#21147) (JIYEON)
• cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)
• 688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)
• 7c1e175 test: add error locations to require-await (#21145) (Grit)
• 588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)
• 059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)
• 5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

... (truncated)

Commits

• c049dc3 10.8.1
• a3f7826 Build: changelog update for 10.8.1
• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173)
• 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196)
• 7d0cbf8 docs: Update README
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191)
• 5611035 test: add error locations info to no-void (#21185)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176)
• f131c03 chore: improve ecosystem test failure reporting (#20937)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183)
• Additional commits viewable in compare view

[BernardJen]

Blocked upstream — this cannot be merged or rebased into a working state today.

CI fails at npm ci with an ERESOLVE conflict. That conflict is not just a stale lockfile: I re-resolved the whole tree from scratch (no lockfile, npm free to pick any version inside the manifest ranges) and it still fails:

$ # package.json with eslint bumped to ^10.8.1, no package-lock.json
$ npm install --package-lock-only --ignore-scripts
npm error While resolving: slidecue@0.7.4
npm error Found: eslint@10.8.1
npm error Could not resolve dependency:
npm error peer eslint@"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" from eslint-plugin-react@7.37.5

The blocker is eslint-plugin-react. Version 7.37.5 is the latest published release, and its eslint peer range stops at ^9.7. There is no published version of eslint-plugin-react that accepts ESLint 10, so no lockfile refresh can satisfy it.

Note the CI log surfaces @typescript-eslint/eslint-plugin@8.50.1 as the conflict instead — that one is a red herring. It's genuinely fixable (8.61.1+ widened its peer to ^8.57.0 || ^9.0.0 || ^10.0.0, and the manifest range ^8.50.1 already permits that). Once npm gets past it, it hits the eslint-plugin-react wall underneath.

·@·d·ependabot r·ebase will not help here. This PR needs to wait for eslint-plugin-react to ship ESLint 10 support upstream. Leaving open.

Worth knowing separately: ci.yml runs typecheck and test only — it never runs npm run lint. So even once this resolves, CI will not actually exercise ESLint; that will need a manual npm run lint before merging.

---

Generated by Claude Code

[BernardJen]

Not merging — this is a real peer-dependency break, not a flaky check.

npm ci fails outright on this branch (run 31938938634):

npm error code ERESOLVE
npm error While resolving: @typescript-eslint/eslint-plugin@8.50.1
npm error Found: eslint@10.8.1
npm error Could not resolve dependency:
npm error peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/eslint-plugin@8.50.1
npm error Conflicting peer dependency: eslint@9.39.5

Consequence: @typescript-eslint/eslint-plugin@8.50.1 caps out at eslint 9, so the install cannot resolve. Nothing downstream runs — no typecheck, no tests. ci.yml on main is green at e9384d21, so this failure belongs to the bump, not to a pre-existing condition.

This needs @typescript-eslint/* v9 (the line that adds eslint 10 peer support) to land in the same PR. Bumping eslint alone can't work regardless of how many times it's rebased.

Leaving open rather than closing, since it becomes mergeable once typescript-eslint is bumped alongside it.

---

Generated by Claude Code

[BernardJen]

Correcting my previous comment — it named the wrong blocker, and following it would waste a maintainer's time.

That comment said this "becomes mergeable once typescript-eslint is bumped alongside it." That is not true, and no bump inside the current manifest ranges will make this mergeable.

@typescript-eslint/eslint-plugin is a red herring. It is what the CI log surfaces, but it is already fixable without touching package.json: 8.62.1 (published 2026-06-29) widened its peer range to ^8.57.0 || ^9.0.0 || ^10.0.0, and the manifest range ^8.50.1 already permits everything up to today's 8.67.0. Only the committed lockfile pins 8.50.1:

$ git show pr31:package-lock.json | ... node_modules/@typescript-eslint/eslint-plugin
8.50.1

The actual wall is eslint-plugin-react. Re-resolving the whole tree today from this branch's manifest with no lockfile — npm free to pick any in-range version — gets past typescript-eslint and stops here instead:

$ npm install --package-lock-only --ignore-scripts
npm error While resolving: slidecue@0.7.4
npm error Found: eslint@10.8.1
npm error Could not resolve dependency:
npm error peer eslint@"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" from eslint-plugin-react@7.37.5

I scanned every published version of eslint-plugin-react on the registry, prereleases included, for one whose eslint peer range admits 10:

does ANY published version of eslint-plugin-react accept eslint 10?
  NONE — no release accepts eslint 10

Latest stable is 7.37.5, published 2025-04-03, capped at ^9.7; the next tag (7.8.0-rc.0) does not admit 10 either.

Consequence: a rebase, a lockfile refresh, and a coordinated typescript-eslint bump all fail the same way. This PR cannot reach a mergeable state until eslint-plugin-react ships ESLint 10 support upstream — that is the thing to watch, not typescript-eslint. Leaving it open, since it resolves on its own once upstream moves.

Also worth keeping in mind for whenever it does land: ci.yml runs typecheck and test only — it never runs npm run lint. So CI will not actually exercise ESLint even when green, and this needs a manual npm run lint before merging.

---

Generated by Claude Code

[BernardJen]

Not merged — ESLint 10 is not yet installable in this repo, and no rebase will fix it.

CI is red here, but the failure is not a test failure — npm ci never gets as far as running anything:

npm error code ERESOLVE
npm error Could not resolve dependency:
npm error peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/eslint-plugin@8.50.1

That first blocker is genuinely fixable — @typescript-eslint/* 8.67.0 widened its range to ^8.57.0 || ^9.0.0 || ^10.0.0, and #35 is now merged with #36 queued behind it.

But there is a second blocker that those merges do not clear. Resolving this repo's lint toolchain with both typescript-eslint bumps already applied still fails:

$ npm install --package-lock-only --dry-run     # tseslint 8.67 + eslint 10 + eslint-plugin-react 7.37.5
npm error code ERESOLVE
npm error Found: eslint@10.9.0
npm error Could not resolve dependency:
npm error peer eslint@"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" from eslint-plugin-react@7.37.5
npm error node_modules/eslint-plugin-react

eslint-plugin-react@7.37.5 is the latest published release, and it caps ESLint at ^9.7. So there is currently no version combination that satisfies this repo's devDependencies with ESLint 10 — the constraint is upstream, not in our lockfile.

Consequence: merging this would leave main unable to npm ci, which breaks CI and the release workflow (which also runs npm ci) for every subsequent PR.

Recommend leaving this open until eslint-plugin-react ships an ESLint 10 peer range. Re-check on a later triage run rather than rebasing now.

---

Generated by Claude Code

[BernardJen]

Should be unblocked now — please rebase.

CI failed at npm ci (job 97338871398):

npm error Could not resolve dependency:
npm error peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/eslint-plugin@8.50.1
npm error Conflicting peer dependency: eslint@9.39.5

The blocker was @typescript-eslint/eslint-plugin pinned at 8.50.1, which does not accept eslint 10. #36 (bump to 8.67.0) has just been merged, and 8.67.0 widens that peer range:

$ curl -s https://registry.npmjs.org/@typescript-eslint/eslint-plugin/8.67.0 | jq .peerDependencies
{"eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", ...}

So rebasing onto current main should let this resolve. Not merging it myself until CI is actually green on the rebased head.

·@·d·ependabot r·ebase

---

Generated by Claude Code

[BernardJen]

Correcting the previous comment — a rebase will not unblock this. Please disregard the rebase request.

The last comment (2026-08-25) said the blocker was @typescript-eslint/eslint-plugin pinned at 8.50.1, and that rebasing onto main (which now carries 8.67.0 via #36) would let this resolve. That is wrong, and acting on it would waste a cycle. The 2026-08-20 comment on this PR had the correct diagnosis.

This branch already has everything that rebase would bring, and it still fails. The PR's only manifest delta against current origin/main is the eslint bump itself:

$ git diff origin/main pr31 -- package.json
-    "eslint": "^9.39.2",
+    "eslint": "^10.8.1",

@typescript-eslint/* 8.67.0 is already on main and already resolved in this branch's lockfile:

$ git show pr31:package-lock.json | jq '.packages["node_modules/@typescript-eslint/eslint-plugin"].version'
8.67.0

So the named blocker is already cleared here. Running the real install on this branch today still fails, one layer deeper:

$ npm ci
npm error code ERESOLVE
npm error While resolving: eslint-plugin-react@7.37.5
npm error Found: eslint@10.8.1
npm error Could not resolve dependency:
npm error peer eslint@"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" from eslint-plugin-react@7.37.5

The wall is eslint-plugin-react. Checked against the registry today:

$ npm view eslint-plugin-react dist-tags
{ "next": "7.8.0-rc.0", "latest": "7.37.5" }

$ npm view eslint-plugin-react@7.37.5 peerDependencies
{ "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" }

7.37.5 is the latest published release and it caps at ^9.7; the next tag does not admit 10 either. The repo's three other eslint plugins are all fine — eslint-plugin-react-hooks@7.1.1, @typescript-eslint/eslint-plugin@8.67.0 and @typescript-eslint/parser@8.67.0 all list ^10.0.0. eslint-plugin-react is the sole holdout.

Consequence: no rebase, lockfile refresh, or in-range bump can satisfy this. Merging it would leave main unable to npm ci, breaking both ci.yml and the release workflow (which also runs npm ci) for every subsequent PR. The thing to watch is eslint-plugin-react shipping an ESLint 10 peer range — not typescript-eslint. Leaving this open; it resolves on its own once upstream moves.

Separately, still true and worth carrying forward: ci.yml runs npm ci → typecheck → vitest and never runs npm run lint. So even once this resolves, a green check would not mean ESLint 10 actually works on this codebase — that needs a manual npm run lint before merging.

---

Generated by Claude Code

[dependabot]

Superseded by #51.