Skip to content

chore(deps-dev): bump eslint from 9.39.5 to 10.9.0 in /web - #19

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/eslint-10.8.1
Closed

chore(deps-dev): bump eslint from 9.39.5 to 10.9.0 in /web#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/eslint-10.8.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor

Bumps eslint from 9.39.5 to 10.9.0.

Release notes

Sourced from eslint's releases.

v10.9.0

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

  • 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
  • 87f66f4 docs: Update README (GitHub Actions Bot)
  • 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
  • f3993b0 docs: Update README (GitHub Actions Bot)
  • ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
  • 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
  • 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
  • 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

  • 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
  • 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
  • dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
  • f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
  • 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])

v10.8.1

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

  • 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
  • 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
  • 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
  • ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
  • f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
  • 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
  • d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)

... (truncated)

Commits

@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/web/eslint-10.8.1 branch from 443ba62 to 415b4d9 Compare August 24, 2026 08:25
@piotrlaczkowski
piotrlaczkowski force-pushed the main branch 2 times, most recently from a85446a to 1d710eb Compare August 24, 2026 09:52
piotrlaczkowski added a commit that referenced this pull request Aug 27, 2026
…#22)

* build(deps): React 19, Vite 8, Vitest 4, and the GitHub Actions majors

Closes the dependabot backlog in one sweep rather than 17 sequential
rebase-and-merge cycles: every one of those PRs touches package.json or
package-lock.json, so each merge conflicts the next and the queue can only
drain one CI round at a time.

── GitHub Actions (7 PRs) ────────────────────────────────────────────────────

checkout 4→7, setup-go 5→7, setup-node 4→7, setup-python 5→7, deploy-pages 4→5,
upload-pages-artifact 3→5, action-gh-release 2→3. Mechanical; the v4/v5 majors
were also emitting Node 20 deprecation warnings on every run.

── Web (7 of 10 PRs) ─────────────────────────────────────────────────────────

react + react-dom 18.3.1→19.2.8, @types/react 19, @dnd-kit/sortable 8→10
(with core →6.3.0 for its peer), vite 5→8, @vitejs/plugin-react 4→6,
vitest + @vitest/coverage-v8 2→4, globals 15→17, eslint-plugin-react-hooks 5→7,
typescript-eslint →8.68.0.

Three things had to change for these to work:

  • React 19 types. `useRef<T>(null)` now yields `RefObject<T | null>` rather
    than `RefObject<T>` — the honest type, since a ref genuinely is null until
    its element mounts. Fixed at the three declaration sites (useStickToBottom's
    return, Modal's initialFocusRef, HITLPopup's firstActionRef) rather than
    cast away at the ~10 use sites.

  • Vite 8 builds on rolldown, which accepts `manualChunks` only as a callback
    and fails the build outright on the object form. Same three vendor chunks
    (react / dnd / icons), matched on module id.

  • `__dirname` in the vite and vitest configs, which Vite 8's native config
    loader warns about. Now `import.meta.dirname`.

── The new React Compiler lint rules are OFF, deliberately ──────────────────

eslint-plugin-react-hooks v7 enables a family of rules derived from the React
Compiler. They flag 42 EXISTING patterns across Studio — not regressions, just
constructs the compiler cannot prove safe to memoize, setState-inside-an-effect
being most of them.

They are off rather than warnings because a warning nobody can act on 42 times
is noise that trains people to ignore the whole report. Adopting them is a real
refactor of state flow across the app and deserves its own review, not a
silent rewrite of every effect riding along in a version bump.

rules-of-hooks and exhaustive-deps — the two that caught real shipped bugs —
stay errors. The gate is not weakened by one rule: eslint still reports
0 errors and the same 50 pre-existing warnings it did before.

── Three PRs are NOT adoptable, and the blocker is upstream ─────────────────

  typescript 5.9.3 → 7.0.2 (#17)
    typescript-eslint caps TypeScript at <6.1.0 — including its own 8.68.1
    alphas. Taking TS 7 means deleting TypeScript linting from the project.

  eslint 9.39.5 → 10.8.1 (#19) and @eslint/js → 10.0.1 (#11)
    eslint-plugin-jsx-a11y's newest release (6.10.2) peers eslint ^3..^9 only.
    No ESLint 10 support has shipped.

Forcing either with --legacy-peer-deps produces a tree whose linting is
silently broken, which is worse than staying on the current major. They stay
open until the ecosystem catches up.

Verified: tsc clean, eslint 0 errors, 79/79 vitest, vite build green, Go build
+ lint at the zero baseline + full suite clean, and Studio exercised in a
browser under React 19 — SSE connected, all chunks and API calls 200, the
composition preview and phase rail rendering correctly.

* ci: run Node 22, which the new web toolchain requires

Vitest 4 pulls a jsdom whose undici calls `webidl.util.markAsUncloneable`,
added in Node 22.10. On CI's Node 20 that is a TypeError thrown while merely
IMPORTING jsdom, so every test file failed to start — 9 unhandled errors and
'no tests' rather than a test failure.

Two jobs disagreed about this and the disagreement hid it: Web Frontend Check
only runs tsc and the build, so it passed; Lint & Test and Pre-commit run
`make check`, which runs vitest, and both failed. A green check on the job
named after the frontend was reporting on half of it.

`engines: node >=22.10` in web/package.json makes the floor explicit, so a
mismatch fails at install time with a readable message instead of at test time
with a TypeError from inside a transitive dependency. Docs updated from the
stale 'Node 18+' to match.
@piotrlaczkowski

Copy link
Copy Markdown
Contributor

Blocked upstream — not mergeable today.

eslint-plugin-jsx-a11y has no ESLint 10 support; its newest release peers ESLint 9 at most:

$ npm view eslint-plugin-jsx-a11y version peerDependencies
6.10.2  { eslint: '^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9' }

Forcing it with --legacy-peer-deps would leave the a11y rules silently not running, which is worse than staying on ESLint 9.

Leaving this open until jsx-a11y ships ESLint 10 support. Note that #13 (eslint-plugin-react-hooks 7) did land in #22 — it supports both majors.

Bumps [eslint](https://github.com/eslint/eslint) from 9.39.5 to 10.9.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.5...v10.9.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps-dev): bump eslint from 9.39.5 to 10.8.1 in /web chore(deps-dev): bump eslint from 9.39.5 to 10.9.0 in /web Aug 27, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/web/eslint-10.8.1 branch from 415b4d9 to 41b64ed Compare August 27, 2026 17:28
@dependabot @github

dependabot Bot commented on behalf of github Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #28.

@dependabot dependabot Bot closed this Aug 30, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/web/eslint-10.8.1 branch August 30, 2026 03:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant