Skip to content

Bump eslint from 9.39.2 to 10.9.0 - #51

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/eslint-10.9.0
Closed

Bump eslint from 9.39.2 to 10.9.0#51
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/eslint-10.9.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 28, 2026

Copy link
Copy Markdown
Contributor

Bumps eslint from 9.39.2 to 10.9.0.

Release notes

Sourced from eslint's releases.

v10.9.0

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

  • 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
  • 87f66f4 docs: Update README (GitHub Actions Bot)
  • 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
  • f3993b0 docs: Update README (GitHub Actions Bot)
  • ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
  • 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
  • 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
  • 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

  • 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
  • 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
  • dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
  • f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
  • 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])

v10.8.1

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

  • 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
  • 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
  • 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
  • ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
  • f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
  • 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
  • d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 28, 2026
Bumps [eslint](https://github.com/eslint/eslint) from 9.39.2 to 10.9.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.2...v10.9.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.9.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/eslint-10.9.0 branch from 787ddc4 to dec4af1 Compare August 31, 2026 06:15

Copy link
Copy Markdown
Contributor

Not merging — ESLint 10 has no compatible eslint-plugin-react release yet.

Reproduced locally:

$ npm ci
npm error Could not resolve dependency:
npm error peer eslint@"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" from eslint-plugin-react@7.37.5
npm error Conflicting peer dependency: eslint@9.39.5

This is why the ci check is red — npm ci is CI's first step, so it fails in ~11s.

From the npm registry, eslint-plugin-react@7.37.5 is the latest stable and tops out at ^9.7. ESLint 10 support first appears in 7.8.0-rc.0 (the next tag), still a release candidate. So this PR is blocked until eslint-plugin-react@7.8.0 ships stable, and then both need to move in one PR.

Worth knowing: this whole toolchain is currently inert. There is no eslint.config.* or .eslintrc* anywhere in the tree, and no workflow runs the lint script — consistent with the earlier commit "CI: run type check + tests, drop unconfigured lint step". So eslint, eslint-plugin-react, eslint-plugin-react-hooks and @typescript-eslint/* are dev dependencies that nothing exercises, while their peer ranges block this PR and #47 (typescript 7).

Two ways out, both cheaper than waiting: wire up a working flat config on versions that support ESLint 10 and TS 7, or drop the unused eslint packages and close this. Either unblocks #47 at the same time. Flagging for a human decision rather than picking one — removing dev dependencies is beyond a dependency bump.


Generated by Claude Code

Copy link
Copy Markdown
Contributor

Correcting my previous comment on one point — it pointed at a release that will not help.

I said ESLint 10 support "first appears in 7.8.0-rc.0 (the next tag)" and that this PR is blocked until 7.8.0 ships stable. That is wrong. 7.8.0-rc.0 is an older prerelease, not a newer one — 7.8.0 < 7.37.5 in semver — and its peer range is narrower, not wider:

$ curl -s https://registry.npmjs.org/eslint-plugin-react | jq '.["dist-tags"]'
{ "next": "7.8.0-rc.0", "latest": "7.37.5" }

  next    7.8.0-rc.0  peer eslint = ^3.0.0 || ^4.0.0
  latest  7.37.5      peer eslint = ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7

So there is no eslint-plugin-react release that supports ESLint 10 — not stable, not prerelease. Waiting for 7.8.0 would be waiting for something that already shipped years ago. The npm ci failure itself stands exactly as reported:

npm error peer eslint@"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" from eslint-plugin-react@7.37.5
npm error Conflicting peer dependency: eslint@9.39.5

This makes the "worth knowing" part of the earlier comment the actual path forward rather than a side note. There is no eslint.config.* or .eslintrc* in the tree and no workflow runs lint, so eslint, eslint-plugin-react, eslint-plugin-react-hooks and @typescript-eslint/* are inert dev dependencies — yet their peer ranges are what block this PR and #47.

Two viable options, and "wait for upstream" is not one of them:

  1. Drop the unused ESLint dev dependencies. Unblocks this PR and Bump typescript from 5.9.3 to 7.0.2 #47 together, at the cost of nothing currently running.
  2. Wire up a real flat config on packages that do support ESLint 10 — @typescript-eslint/* v8.69.0 already declares eslint: ^8.57.0 || ^9.0.0 || ^10.0.0, so the gap is eslint-plugin-react specifically, which would need replacing or dropping.

Note that option 2 unblocks this PR but not #47: @typescript-eslint/eslint-plugin@8.69.0 still caps TypeScript at >=4.8.4 <6.1.0, so TypeScript 7 stays blocked either way until typescript-eslint ships TS 7 support.

Still not merging, and still flagging for a human rather than removing dev dependencies myself.


Generated by Claude Code

BernardJen added a commit that referenced this pull request Sep 3, 2026
#64)

`npm run lint` has never worked (#63). The script existed from the start but
no config ever did, so eslint exited non-zero on every invocation, and nothing
caught it because no workflow ran it.

Fixing that also unblocks #51. Dependabot's eslint 9 -> 10 bump was failing at
`npm ci` with ERESOLVE, not at any check step: eslint-plugin-react@7.37.5 peers
`eslint ^3 || ... || ^9.7` and has no release that accepts 10 (the `next` tag is
a stale 7.8.0-rc.0 peering ^3 || ^4). The plugin was also dead weight - with no
config, nothing had ever referenced it. Dropping it and moving
@typescript-eslint to ^8.69.0, the first line peering `^8.57 || ^9 || ^10`,
leaves nothing in the tree capping eslint's major.

The new config is deliberately not built on @eslint/js, which peers a single
eslint major and would recreate this exact failure on the next bump.

Getting to a clean run needed some dead code removed: unused imports, two catch
bindings that were never read, and `currentPresentationPath` in both Windows
backends, which was written twice and read never (macos.ts genuinely reads it
as a fallback, so it stays there). `require-atomic-updates` is set to 'warn'
rather than disabled - it flags seven pre-existing interleaving hazards in the
automation backends that need a real PowerPoint install to fix safely.

CI runs lint now, between install and typecheck. A lint script no job runs is
how this went unnoticed for the life of the repo.

Finally, dependabot grouping, because #51 was one of four PRs failing the same
way: a solo bump of a package whose peers are pinned to a sibling's major can
never resolve alone. #49 and #50 are the clearest case - one bumps vite to 8,
the other bumps @vitejs/plugin-react to a version requiring vite 8, and each
fails precisely because the other is a separate PR.

Two of the four remain blocked upstream and are not addressed here: #47
(typescript 7) waits on @typescript-eslint, which still peers `<6.1.0`, and
#49/#50 wait on electron-vite 6 leaving beta, since 5.0.0 peers `vite ^5 ||
^6 || ^7`. Grouped, those now sit still instead of failing every week.

Refs #63, #51

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #65.

@dependabot dependabot Bot closed this Sep 3, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/eslint-10.9.0 branch September 3, 2026 19:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant