build(deps-dev): bump eslint from 10.8.1 to 10.9.1 - #1136
Conversation
Bumps [eslint](https://github.com/eslint/eslint) from 10.8.1 to 10.9.1. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.1...v10.9.1) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.9.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 1 potential issue.
⚠️ 1 issue in files not directly in the diff
⚠️ Required dependency checks always fail
The lock refresh removes peer from all 26 platform-specific esbuild records. Two required contract tests reject the lock, so every PR verification run fails.
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
The PR updates the eslint dependency from 10.8.1 (and 10.7.0 in some package.json files) to 10.9.1 across the workspace. This is a minor version bump of a development tool, which typically includes bug fixes and performance improvements without breaking changes. The package-lock.json changes are consistent with the version bump and standard npm lockfile updates.
Reviewed changed lines
apps/desktop/package.json:41 (RIGHT): Updated eslint to ^10.9.1 to keep linting tools current.packages/shared-types/package.json:14 (RIGHT): Updated eslint to ^10.9.1 for consistency across the monorepo.package-lock.json:4675 (RIGHT): Lockfile updated to resolve eslint to version 10.9.1.
Adversarial validation
apps/desktop/package.json:41 (RIGHT)falsified: The version bump to 10.9.1 introduces a breaking change in the ESLint API that prevents the 'lint' script from running. — ESLint 10.9.1 is a patch/minor release; no breaking API changes reported that would invalidate standard CLI usage in 'eslint "src/**/*.{ts,tsx}" vite.config.ts'.package-lock.json:4675 (RIGHT)falsified: The lockfile changes introduce an incompatible dependency tree or remove critical peer dependencies. — The removal of 'peer: true' in the lockfile is a common artifact of npm version updates/lockfile regeneration and does not affect the functional installation of the package on the target platforms.- Residual risk: Low. Minor version updates in ESLint rarely introduce breaking changes to existing rule configurations, but could potentially introduce new warnings or errors if new rules are enabled by default.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
32bbb8ba067ace3365de8ce04a79949457aa7e33 - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact head 32bbb8ba067ace3365de8ce04a79949457aa7e33 carries a valid eslint 10.9.1 update but its generated root package-lock.json deletes peer: true from every root node_modules/@esbuild/* platform record. That is the same repository-canonical lock provenance failure now reproduced by #1133/#1134 and owned by #896. Keep the dependency update, but regenerate the full lock with repository-canonical npm 10.9.9 on current protected ancestry and prove frozen npm ci, test_lock_records_match_exact_registry_artifacts_and_preserve_peer_metadata, test_root_lock_preserves_esbuild_peer_metadata, and full quickcheck on the unchanged repaired head. No manual lock editing or gate weakening.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact head 32bbb8ba067ace3365de8ce04a79949457aa7e33 reproduces the same canonical npm lock-provenance RED as the adjacent Dependabot updates. ci run 33589624972 / job 100268985342 fails quickcheck in exactly two repository contracts: test_lock_records_match_exact_registry_artifacts_and_preserve_peer_metadata and test_root_lock_preserves_esbuild_peer_metadata; the reported first missing record is node_modules/@esbuild/aix-ppc64 with peer: true stripped. The repository-pinned npm 10.9.9 runtime is verified in the run, so this is an invalid generated lock delta, not an excuse to weaken the gate.
Keep the ESLint 10.9.1 semantic delta, but repair it through canonical lock-generation owner #896 (or a verified successor) with a complete npm 10.9.9 regeneration that preserves @esbuild/* peer metadata, then rerun exact-head CI/release. Do not hand-edit package-lock.json, weaken the regression tests, or close this PR until the unique ESLint delta is fully and verifiably superseded.
1 participant
Bumps eslint from 10.8.1 to 10.9.1.
Release notes
Sourced from eslint's releases.
Commits
5c8c24110.9.1a7f3b7dBuild: changelog update for 10.9.11e641c9fix: no-loss-of-precision false positive with trailing decimal point (#21251)ad74a8ddocs: add deprecation steps for EOL package versions (#21248)3c3ae53chore: update ecosystem plugins (#21249)c27bc9210.9.0fa831d9Build: changelog update for 10.9.0899dbf1chore: update github/codeql-action action to v4.37.7 (#21243)08de88efeat: handle underflow in no-loss-of-precision (#21218)9ef407adocs: use eslint.config.* wherever config file names are listed (#21216)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)