build(deps-dev): bump eslint from 9.39.4 to 10.7.0#107
Conversation
Bumps [eslint](https://github.com/eslint/eslint) from 9.39.4 to 10.7.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v10.7.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.7.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
CI built on Node 20, the Dockerfile ships node:22-alpine, and local dev runs Node 26. CI was validating a runtime we do not deploy. The split also broke Dependabot. Node 20 and node:22-alpine both bundle npm 10; a newer npm generates a lockfile tree that npm 10 rejects: npm error code EUSAGE npm error Missing: esbuild@0.28.1 from lock file That is why #106, #107 and #111 are red. It is not a fault in those bumps — their lockfiles were generated by npm 11. The same lockfile would have failed `npm ci` in the Docker build, so this was heading for a broken image, not just a red check. The compatibility runs one way only, which decides the fix: lock generated by npm 11 -> npm 10 FAILS, npm 11 ok lock generated by npm 10 -> npm 10 ok, npm 11 ok So: - CI node-version 20 -> 22, matching the Dockerfile. - engines.node ">=22" documents the floor. Deliberately a floor rather than "22.x" so local Node 26 does not emit EBADENGINE on every install. - packageManager "npm@10.9.8" pins the generator, which is what stops Dependabot re-introducing an npm 11 lockfile next cycle. Lockfile regenerated with npm 10.9.8: unchanged at 839 packages, +3 lines for the engines block. Verified `npm ci` under npm 10.9.8, `next build`, and vitest (9 files, 279 tests) all pass. The three Dependabot PRs need their lockfiles regenerated on top of this. Co-authored-by: Claude <noreply@anthropic.com>
|
Closing: eslint 10 is not supportable here yet, and this is an upstream block rather than anything wrong with the bump.
No eslint 10 support. eslint 10 removed the deprecated rule-context methods, so Worth noting this would not have been caught by CI: Verified on Blocked until Next.js ships an |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
eslint 10 removed the deprecated rule-context methods. eslint-plugin-react 7.37.5 (latest, and what eslint-config-next 16.2.10 depends on) still declares a peer range topping out at ^9.7, so `npm run lint` crashes on rule load rather than reporting. Closed as #107; this stops it returning weekly. Scoped to majors, so 9.x patches still flow. Co-authored-by: Claude <noreply@anthropic.com>
1 participant
Bumps eslint from 9.39.4 to 10.7.0.
Release notes
Sourced from eslint's releases.
... (truncated)
Commits
fabd99b10.7.037c5e75Build: changelog update for 10.7.09489379chore: update dependency@eslint/eslintrcto ^3.3.6 (#21076)81a4774chore: updates for v9.39.5 release3e7bf15fix: applyignoreClassesWithImplementsto class expressions (#21069)9835414chore: enable$ExpectTypeannotations in all TypeScript files (#21071)cf2a9bffeat: add errorClassNames option to preserve-caught-error rule (#21032)c30d808docs: Update READMEf8b873afeat: max-nested-callbacks option for constructor callbacks (#21063)72adf6bchore: restrictmarkdownlint-cli2updates in renovate (#21067)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)