fix(deps): bump eslint to ^10.0.0 — unblocks @eslint/js 10.x (CI run #443)

[Sbussiso]

What

Fixes the CI failure on Dependabot PR #75 (build(deps-dev): bump @eslint/js from 9.39.4 to 10.0.1) — GitHub Actions run #28824401910, job Frontend audit + build, step Install dependencies.

Root cause

Dependabot bumped @eslint/js to 10.0.1 but left eslint pinned at ^9.39.4. @eslint/js@10.0.1 declares peerOptional eslint: "^10.0.0", which conflicts with eslint@9.39.4, so npm ci fails with:

npm error ERESOLVE could not resolve
npm error While resolving: @eslint/js@10.0.1
npm error Found: eslint@9.39.4
npm error Could not resolve dependency:
npm error   peerOptional eslint "^10.0.0" from @eslint/js@10.0.1

This is a Dependabot-known limitation: it bumps one package at a time and doesn't account for the new peer dependency @eslint/js@10 added on its sibling eslint (see eslint/eslint#20467, which added eslint to @eslint/js's peerDependencies at the 10.0.0 release).

Fix

Align eslint to ^10.0.0 (resolves to 10.6.0) so the peer constraint is satisfied. This supersedes / absorbs Dependabot PR #36 (build(deps-dev): bump eslint from 9.39.4 to 10.6.0) — both bumps end at the same eslint@10.6.0.

Verification (run in sandbox against this branch)

All four Frontend audit + build gates exercised locally:

Gate	Result
npm ci	✅ exit 0, 0 vulnerabilities
npx eslint .	✅ exit 0 — warnings only (no errors)
npm test (vitest)	✅ 85/85 passed (10 files)
npm run build	✅ success (343ms)

Lint produces no new errors under eslint 10. The warnings are the same react-hooks/exhaustive-deps and react-refresh/only-export-components advisories already present under eslint 9, plus the react-hooks/set-state-in-effect advisory the v7 plugin already emits — all already demoted to warn in eslint.config.js. No source changes were required; the flat config is compatible with both eslint 9 and 10.

Notes for review

• This PR targets dependabot/npm_and_yarn/frontend/eslint/js-10.0.1 (PR build(deps-dev): bump @eslint/js from 9.39.4 to 10.0.1 in /frontend #75's branch), not master. Merging this into build(deps-dev): bump @eslint/js from 9.39.4 to 10.0.1 in /frontend #75's branch lets Dependabot's PR go green; build(deps-dev): bump @eslint/js from 9.39.4 to 10.0.1 in /frontend #75 can then merge to master carrying both the @eslint/js and eslint bumps together.
• Alternatively the maintainer can close build(deps-dev): bump @eslint/js from 9.39.4 to 10.0.1 in /frontend #75 and build(deps-dev): bump eslint from 9.39.4 to 10.6.0 in /frontend #36 and merge this directly to master (it carries the @eslint/js bump via the lockfile). Either path lands eslint@10.6.0 + @eslint/js@10.0.1.
• Marked draft pending CI confirmation on GitHub's runners.

[Sbussiso]

Closing as obsolete — the state this PR was trying to reach is already on master.

This is one of ~49 stale draft PRs, most of them repeated attempts at the same few fixes (roughly 20 are variations of "pin click>=8.3.3"). Each CI failure appears to have opened a new PR rather than updating an existing one, so the backlog grew without ever converging.

Verified before closing — every advisory these were chasing is resolved:

dependency	locked on master
click	8.5.0
cryptography	50.0.1
pip	26.2
@babel/core	7.29.7

pip-audit --strict reports No known vulnerabilities found, and Dependabot shows 0 open advisories across all four repos.

Nothing is lost by closing: the one piece of real engineering knowledge in this batch — that svix 2.0.0 changed Webhook.verify() to return None — is already implemented in backend/app/api/webhooks.py, which calls wh.verify() for validation and then json.loads() the verified payload. That pattern works on both svix 1.x and 2.x.

Reopen if you disagree; nothing here was deleted.