Bump eslint and @eslint/js to 10, together - #294
Merged
Merged
Conversation
Dependabot split these across two PRs (#249 eslint 10.10.0, #75 @eslint/js 10.0.1) which cannot be merged independently — @eslint/js supplies the recommended rule set that eslint consumes, and they share a major line. Taken as a pair instead. The project is already on flat config (`eslint.config.js`), which is the whole of the 9 -> 10 migration for this codebase. Verified by running both versions against the same tree: eslint 9.39.4 and eslint 10.10.0 each report 47 problems, 13 errors, 34 warnings — identical. The major introduces zero new findings here. Also checked: npm audit --audit-level=high --omit=dev finds 0 vulnerabilities, 99 frontend tests pass, vite build succeeds. Those 13 pre-existing errors are not from eslint and are not new — they are react-hooks/immutability (12) and react-hooks/use-memo (1) from eslint-plugin-react-hooks 7.1.1, unchanged by this bump. They survive in master because `npm run lint` is not part of CI, which is tracked separately. Closes #249 Closes #75 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sbussiso
added a commit
that referenced
this pull request
Sep 12, 2026
`eslint.config.js` was added specifically because `npm run lint` had been silently erroring with "couldn't find a config" and the lint command was a no-op. The config fixed that — and then nothing ever ran it. The frontend CI job does `npm ci`, `npm audit`, `npm test` and the build, and never the linter. So the no-op survived the fix. Thirteen errors accumulated in master unnoticed, and the eslint 9 -> 10 major in #294 had to be reviewed by running the linter by hand, because CI could say nothing about it. Two changes: - deploy.yml gains a `Lint (eslint)` step in the frontend job. - The two React Compiler advisories that were holding lint at a non-zero exit join the four already demoted to `warn` by the policy written into this config. `react-hooks/immutability` (12) fires on `useEffect(() => { loadThings() }, [...])` where `loadThings` is a `const` declared further down — correct at runtime, since effects run after render, so it is the compiler reporting it cannot track the value rather than a live bug. `react-hooks/use-memo` (1) fires on a non-inline first argument. Hoisting the six files' loaders is a real change that belongs with the next edit to each, not bundled here. Warnings stay visible in the CI log; only errors fail the build. That split is the point. Verified the gate is not vacuous: lint exits 0 on the current tree (47 warnings, 0 errors), and exits 1 with a deliberate `no-undef` planted in src/. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot split this single migration across two PRs that cannot be merged
independently — #249 (
eslint9.39.4 → 10.10.0) and #75 (@eslint/js9.39.4 → 10.0.1).
@eslint/jssupplies the recommended rule set thateslint.config.jsspreads into its own rules, and the two share a majorline. This takes them as a pair.
Why this major is a non-event here
The project is already on flat config (
eslint.config.js), which is thewhole of the 9 → 10 migration for this codebase.
I ran both versions against the same tree to confirm rather than assume:
Identical. The major introduces zero new findings.
Also verified locally
npm audit --audit-level=high --omit=dev→ 0 vulnerabilitiesnpm test→ 12 files, 99 tests passednpm run build→ builds cleanAbout those 13 errors
They are not new and not from eslint:
react-hooks/immutability(12) and
react-hooks/use-memo(1), fromeslint-plugin-react-hooks7.1.1, which this PR does not touch.
They survive in
masterbecausenpm run lintis not part of CI — theFrontend audit + buildjob runsnpm ci,npm audit,npm testand thebuild, but never the linter. Tracked separately; out of scope for a
dependency bump.
Closes #249
Closes #75
🤖 Generated with Claude Code