Skip to content

Update eslint (major) - #2458

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-eslint
Closed

Update eslint (major)#2458
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-eslint

Conversation

@renovate

@renovate renovate Bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@cloudfour/eslint-config 25.0.1 → 26.0.0 age confidence
eslint (source) 9.39.5 → 10.9.1 age confidence

Release Notes

cloudfour/eslint-config (@​cloudfour/eslint-config)

v26.0.0

Compare Source

Breaking Changes

  • Rebuild on eslint-config-xo v1 and remove the vendored copy of eslint-config-standard. xo now bundles most of what we assembled by hand, so eslint-config-prettier, eslint-plugin-import-x, eslint-plugin-jsdoc, eslint-plugin-n, eslint-plugin-unicorn and typescript-eslint are no longer direct dependencies — they arrive through xo, and xo decides their versions. Three direct dependencies remain: eslint-config-xo, eslint-plugin-promise and globals. Our own overrides are unchanged.

    Of the 106 rules the vendored standard config still contributed, xo already enabled 95. The seven that survive (no-empty-character-class, no-invalid-regexp, no-useless-backreference, n/handle-callback-err, n/no-callback-literal, n/no-exports-assign, promise/param-names) are now set explicitly. standard's remaining value was formatting, which Prettier already handles for us.

    This turns on a meaningful number of new rules. Measured against a real project, roughly 250 new reports across 64 TypeScript files, mostly from require-unicode-regexp (the v flag), @typescript-eslint/strict-boolean-expressions, curly and n/prefer-global/process.

    xo also lints package.json, JSON, Markdown and CSS, which it did not before. One of its package.json rules is off: dependency-version-range, because we pin exact versions deliberately and it fires on every project, including applications that never publish anything. The rest apply, including sort-properties, which reorders top-level fields to npm's canonical sequence the first time it runs.

    Three of xo's opinions are turned back off because they contradict decisions we had already made:

    • @typescript-eslint/no-restricted-types no longer bans null as a type. That is the same opinion as unicorn/no-null, which we have always disabled. xo's other restrictions are kept.
    • @typescript-eslint/naming-convention is off. It cannot distinguish our names from names that come from someone else's contract, so it flags things like Authorization headers and generated GraphQL types.
    • jsdoc/require-asterisk-prefix is back to always. xo sets it to never, which wants JSDoc written without the leading asterisk on continuation lines.

  • Import rules move from the import/* namespace to import-x/*. We used to depend on eslint-plugin-import and later replaced it with eslint-plugin-import-x, registered under the name import to keep rule names stable. eslint-plugin-import has not released since June 2025 and does not support ESLint 10, which is what forced the swap. Now that xo bundles import-x under its own import-x namespace, we use that directly. Any eslint-disable comment naming an import rule needs updating:

    - // eslint-disable-next-line import/order
+ // eslint-disable-next-line import-x/order

  • Replace main with exports. The package now declares "exports": "./eslint.config.js" instead of "main", and adds "sideEffects": false. import cloudFourConfig from '@cloudfour/eslint-config' is unaffected. What changes is that deep imports are now blocked: import '@cloudfour/eslint-config/eslint.config.js' throws ERR_PACKAGE_PATH_NOT_EXPORTED. That path resolved to the same module as the package root, so it was an unusual thing to write, but anything doing it needs to import the package root instead.

  • Drop ESLint 9 support. The eslint peer range is now ^10.6.0. The previous >= 9 range was never accurate either — eslint-plugin-unicorn has required >=9.38.0 since v63.

  • Remove the custom @cloudfour/prefer-early-return rule, along with the @cloudfour plugin namespace. eslint-plugin-unicorn ships an equivalent unicorn/prefer-early-return, which we now use with maximumStatements: 2 so it reports exactly the same cases the old rule did. We would rather not maintain a lint rule that exists upstream.

    Any eslint-disable comments naming the old rule will now fail with "Definition for rule '@​cloudfour/prefer-early-return' was not found". Replace them:

    - // eslint-disable-next-line @cloudfour/prefer-early-return
+ // eslint-disable-next-line unicorn/prefer-early-return

  • Change the supported Node versions from >=22.16.0 to ^22.13.0 || >=24, matching what ESLint and our other dependencies actually support. This drops Node 23.x, which was never really supported.

Major Changes

  • Require ESLint v10.6 or newer. eslint-config-xo declares >=10.4, but it configures no-constant-binary-expression with an option ESLint did not support until v10.6, so its own range is optimistic. Our CI job that runs the suite against the oldest ESLint we advertise is what caught this.

  • ecmaVersion is no longer pinned to 2022; xo's latest applies. Pinning it lower made require-unicode-regexp unsatisfiable, since the v flag it requires is newer than the syntax we allowed.

  • eslint-plugin-unicorn moves from v63 to v73 (via xo), which enables around 178 additional rules. Some existing eslint-disable comments for unicorn rules may become stale and need removing.

    Renamed upstream, so any eslint-disable comments using the old names need updating:

    • unicorn/prevent-abbreviations → unicorn/name-replacements (still off)
    • unicorn/no-array-for-each → unicorn/no-for-each
    • unicorn/prefer-dom-node-dataset → unicorn/dom-node-dataset
    • unicorn/no-hex-escape was removed, replaced by unicorn/prefer-unicode-code-point-escapes

    Newly disabled, because they conflict with conventions or duplicate a rule we already run:

    • unicorn/consistent-boolean-name — requires booleans to be named isFoo/hasFoo/etc. A naming opinion, left to reviewers, consistent with our stance on unicorn/name-replacements.
    • unicorn/single-line-block-comment-style — would expand single-line /** @type {…} */ JSDoc across multiple lines.
    • unicorn/require-array-sort-compare — can't distinguish string arrays from number arrays without type information. Replaced with the type-aware @typescript-eslint/require-array-sort-compare for TypeScript files.

    Reconfigured:

    • unicorn/prefer-early-return replaces our removed custom rule, set to maximumStatements: 2 to match it. See the breaking change above.
    • unicorn/filename-case now checks directory names as well as filenames. We ignore __tests__-style directories so conventional names like __tests__, __mocks__ and __snapshots__ don't have to be renamed.
    • @typescript-eslint/no-unnecessary-boolean-literal-compare is now off in favour of unicorn/no-unnecessary-boolean-comparison, which covers the same cases without requiring strictNullChecks and also applies to JavaScript.

  • eslint-plugin-n moves from v17 to v18 (via xo).

  • eslint-plugin-jsdoc moves from v62 to v63 (via xo). An earlier commit in this release took it to v64 directly; xo pins ^63.3.3, so v63 is what ships.

Minor Changes
  • Only publish eslint.config.js to npm. The package previously also shipped repository files such as .editorconfig, .nvmrc, .renovaterc.json and the CI workflow.
eslint/eslint (eslint)

v10.9.1

Compare Source

v10.9.0

Compare Source

v10.8.1

Compare Source

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

v10.8.0

Compare Source

Features

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)

v10.7.0

Compare Source

Features

  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#​21032) (sethamus)
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#​21063) (fnx)
  • 557fde8 feat: support computed Number.parseInt member access in radix rule (#​21041) (Pixel)
  • 0b4a73b feat: add suggestions to no-compare-neg-zero (#​21034) (den$)
  • 96cdd42 feat: report invalid signed numeric radix values in radix rule (#​21030) (Pixel)

Bug Fixes

  • 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#​21069) (Pixel)
  • 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#​21062) (Mahin Anowar)
  • 75ec753 fix: handle static template literals in eqeqeq rule (#​21058) (Pixel)
  • b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#​21057) (Pixel)
  • e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#​21051) (Pixel)
  • a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#​21050) (Pixel)
  • d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#​21045) (spokodev)
  • 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#​21047) (한국)
  • a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#​20958) (sethamus)
  • 8a240a7 fix: avoid false positives in radix rule for spread arguments (#​21044) (Pixel)

Documentation

  • c30d808 docs: Update README (GitHub Actions Bot)
  • 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#​20980) (Alex Bit)
  • 04174cb docs: Update README (GitHub Actions Bot)
  • 026e130 docs: update semver policy for bug fixes (#​21048) (Milos Djermanovic)
  • 9d42fef docs: Update README (GitHub Actions Bot)
  • b230159 docs: Update README (GitHub Actions Bot)
  • 0129972 docs: correct **/.js glob to **/*.js in config files guide (#​21036) (EduardF1)

Chores

v10.6.0

Compare Source

Features

  • b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#​20981) (Taejin Kim)
  • f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#​20948) (sethamus)

Bug Fixes

  • 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#​20997) (Milos Djermanovic)
  • bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#​21013) (den$)
  • 8fd8741 fix: don't report shadowed undefined in radix rule (#​21011) (Pixel)
  • 5784980 fix: don't report shadowed undefined in no-throw-literal (#​21010) (Pixel)
  • 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#​21008) (Pixel)
  • d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#​21006) (Pixel)
  • 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#​21003) (den$)
  • 63d52d2 fix: restore max-classes-per-file report range (#​21002) (Pixel)
  • 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#​20979) (fnx)
  • 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#​20995) (Milos Djermanovic)

Documentation

  • a83683d docs: Update README (GitHub Actions Bot)
  • f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#​20986) (playgirl)
  • bea49f7 docs: Update README (GitHub Actions Bot)
  • e5f70f9 docs: update code-path diagrams (#​20984) (Tanuj Kanti)
  • 8890c2d docs: add TypeScript config guidance for MCP server (#​20796) (Pierluigi Lenoci)
  • 3eb3d9b docs: Update README (GitHub Actions Bot)
  • c5bb59c docs: Update README (GitHub Actions Bot)
  • eb3c97c docs: fix grammar in prefer-const rule description (#​20983) (lumir)

Chores

v10.5.0

Compare Source

Features

  • 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#​20973) (Pixel998)
  • b565783 feat: report no-with violations at the with keyword (#​20971) (Pixel998)
  • 2ce032f feat: report max-lines-per-function violations at function head (#​20966) (Pixel998)
  • 732cb3e feat: report max-nested-callbacks violations at function head (#​20967) (Pixel998)
  • f9c138a feat: report max-depth violations on keywords (#​20943) (Pixel998)
  • bdb496c feat: correct max-depth handling for else-if chains (#​20944) (Pixel998)
  • c296873 feat: update error loc in max-statements to function header (#​20907) (Taejin Kim)

Documentation

  • 8ae1b5b docs: Update README (GitHub Actions Bot)
  • ca7eb90 docs: update Node.js prerequisites to include ICU support (#​20962) (Francesco Trotta)
  • f99b47a docs: Update README (GitHub Actions Bot)
  • acf03d4 docs: clarify precedence of parserOptions over languageOptions (#​20926) (sethamus)

Chores

v10.4.1

Compare Source

Bug Fixes

  • e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#​20930) (Francesco Trotta)
  • d4ce898 fix: propagate failures from delegated commands (#​20917) (Minh Vu)
  • f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#​20916) (kuldeep kumar)
  • c5bc78b fix: false positive for reference in finally block (#​20655) (Tanuj Kanti)
  • 27538c0 fix: add missing CodePath and CodePathSegment types (#​20853) (Pixel998)

Documentation

  • 61b0add docs: remove deprecated rule from related rules of max-params (#​20921) (Tanuj Kanti)
  • 305d5b9 docs: remove deprecated rules from related rules section (#​20911) (Tanuj Kanti)
  • 49b0202 docs: fix display: none of ad (#​20901) (Tanuj Kanti)
  • 9067f94 docs: switch build to Node.js 24 (#​20893) (Milos Djermanovic)
  • c91b041 docs: Update README (GitHub Actions Bot)
  • e349265 docs: clarify semver strings in rule deprecation objects (#​20885) (Milos Djermanovic)

Chores

v10.4.0

Compare Source

Features

  • 1a45ec5 feat: check sequence expressions in for-direction (#​20701) (kuldeep kumar)
  • 450040b feat: add includeIgnoreFile() to eslint/config (#​20735) (Kirk Waiblinger)

Bug Fixes

Documentation

  • 7e52a71 docs: add mention of @eslint-react/eslint-plugin (#​20869) (Pavel)
  • db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#​20865) (Kirk Waiblinger)
  • 9084664 docs: Update README (GitHub Actions Bot)
  • 9cc7387 docs: Update README (GitHub Actions Bot)
  • 3d7b548 docs: Update README (GitHub Actions Bot)
  • 191ec3c docs: Update README (GitHub Actions Bot)

Chores

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@netlify

netlify Bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for cloudfour-patterns ready!

Name Link
🔨 Latest commit 9973d9c
🔍 Latest deploy log https://app.netlify.com/projects/cloudfour-patterns/deploys/6a960dd3f6ccde00088f29ed
😎 Deploy Preview https://deploy-preview-2458--cloudfour-patterns.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@changeset-bot

changeset-bot Bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 9973d9c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/major-eslint branch 5 times, most recently from f6d1440 to 2e9d55d Compare August 31, 2026 18:07
@spaceninja spaceninja mentioned this pull request Aug 31, 2026
Closed
@spaceninja

spaceninja commented Aug 31, 2026

Copy link
Copy Markdown
Member

Leaving this open, but it can't go green as-is. Blocked by eslint-plugin-react, not by anything in this diff.

Every check here is red, but none of them actually ran. It fails at npm ci, before lint, build, test or Storybook get a chance:

npm error ERESOLVE could not resolve
npm error Conflicting peer dependency: eslint@10.9.1
npm error   peer eslint@"^10.6.0" from @cloudfour/eslint-config@26.0.0

eslint-plugin-react@7.37.5 supports eslint: ^3 || … || ^9.7 and nothing newer. It's the latest release, and the next tag is still 7.8.0-rc.0, so there's no prerelease to jump to. Since @cloudfour/eslint-config v26 dropped ESLint 9, the two can't be installed together.

Worth stressing: we have no evidence yet about whether this codebase passes v26's new rules. ESLint never ran. All the red says is "npm couldn't build a tree."

Ticking the rebase box won't help — renovate/artifacts already failed for this same reason, which is why the lockfile still has @cloudfour/eslint-config@25.0.1 while package.json asks for 26.0.0.

The way forward is #2464, which proposes dropping eslint-plugin-react entirely. We use it for exactly one rule (react/jsx-uses-vars, which keeps no-unused-vars quiet about the Storybook imports in our 84 .mdx files), and that may be replaceable with a targeted no-unused-vars disable for MDX rather than a whole dependency.

Keeping this PR open rather than closing it, so it can be rebased once #2464 lands. Closing it would tell Renovate to stop recreating the upgrade, and it'd need un-ignoring from the Dependency Dashboard (#943) to come back.

This was referenced Aug 31, 2026
Open
Merged
spaceninja added a commit that referenced this pull request Aug 31, 2026
@spaceninja
Drop eslint-plugin-react (#2466)
cc2e0dd 
`eslint-plugin-react@7.37.5` declares support for ESLint `^9.7` at most,
and 7.37.5 is the latest release -- the `next` tag is still `7.8.0-rc.0`.
That makes it the one thing preventing this repo from moving to ESLint
10, and with it `@cloudfour/eslint-config` v26, whose peer range is
`^10.6.0`. See #2458, which cannot even `npm ci` today.

We used the plugin for exactly one rule. `react/jsx-uses-vars` marks
JSX-referenced identifiers as used, which our .mdx docs pages need:

    import { Canvas, Meta } from '@storybook/addon-docs/blocks';
    import * as AlertStories from './alert.stories.js';

    <Meta of={AlertStories} />

`no-unused-vars` does not count a JSX reference as a use, so without that
rule it reports every one of those imports -- 171 errors across 83 files,
measured by removing the plugin and running the linter.

Turning `no-unused-vars` off for .mdx files covers the same ground
without the dependency. The trade-off is that a genuinely unused import
in an .mdx file stops being reported; these are documentation pages, so
that seems a cheap price for unblocking the upgrade.

`eslint-plugin-react-x` was considered as a replacement and rejected: at
5.18.6 it has no `jsx-uses-vars` equivalent, so it is not a drop-in.

Closes #2464
@renovate
renovate Bot force-pushed the renovate/major-eslint branch from 2e9d55d to 9973d9c Compare August 31, 2026 23:27
@spaceninja spaceninja mentioned this pull request Sep 1, 2026
Merged
8 tasks
@renovate
renovate Bot deleted the renovate/major-eslint branch September 1, 2026 00:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@spaceninja