build(deps-dev): bump eslint from 10.6.0 to 10.7.0 in the eslint group - #2909
Conversation
Bumps the eslint group with 1 update: [eslint](https://github.com/eslint/eslint). Updates `eslint` from 10.6.0 to 10.7.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.6.0...v10.7.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: eslint ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/eslint-0b04b4102b")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/eslint-0b04b4102b
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/eslint-0b04b4102bPin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "a1f8d1a4ef1eea6b64fb5ed0211d9ec7657162e2")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/eslint-0b04b4102b
git -C submodules/content-scope-scripts checkout a1f8d1a4ef1eea6b64fb5ed0211d9ec7657162e2 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Injected PR Evaluation: Web Compatibility & Security
PR: build(deps-dev): bump eslint from 10.6.0 to 10.7.0
Scope: 2 files changed — package.json, package-lock.json
Web Compatibility Assessment
No findings.
This PR only updates the eslint devDependency version. ESLint is a build-time/lint-time tool and is not bundled into contentScope.js or any injected runtime artifact shipped to browsers. There are no changes to:
injected/src/feature codewrapper-utils.js,captured-globals.js, orDDGProxy- Messaging transports or message bridge
- Platform entry points
- Remote config or feature initialization
Info — package.json:48 — eslint remains under devDependencies; the files publish list does not include ESLint or its config.
Security Assessment
No findings.
No runtime code, API overrides, messaging paths, or global-capture logic are modified. The dependency bump does not affect the trust boundary between page scripts and injected protections.
Info — package-lock.json — Integrity hash updated for eslint@10.7.0 (sha512-GVTD7s1vdIl6UYvAfriOPeY1Df8LIZjfofLvHwde+erDHGGuHyuM6xoxRxmHiebhYuD2p1vN4wWh0XzPARSGDQ==).
Risk Level
Low Risk — Dev-dependency-only semver patch bump with zero changes to injected runtime code, API shims, or security-sensitive subsystems.
Recommendations
- Merge after CI passes — No injected-specific testing required; standard
npm run lintin CI is sufficient validation. - No action needed for web-compat or security review beyond confirming CI green.
Verified locally: ESLint 10.7.0 runs against the codebase with 0 errors (6 pre-existing warnings).
Sent by Cursor Automation: Web compat and sec
There was a problem hiding this comment.
Dependency update review: eslint 10.6.0 → 10.7.0
Verdict: Low risk — approve. No follow-up fix PR is needed.
Diff scope
This PR only bumps the direct eslint devDependency in package.json and the corresponding node_modules/eslint entry in package-lock.json. No transitive lockfile changes and no application source changes.
Changelog impact (10.6.0 → 10.7.0)
ESLint v10.7.0 is a minor release (published 2026-07-10) focused on:
- New optional rule options (
preserve-caught-error.errorClassNames,max-nested-callbacks.checkConstructorCallCallbacks,radixenhancements,no-compare-neg-zerosuggestions) - Bug fixes for
eqeqeq,no-invalid-regexp,no-control-regex,no-implicit-coercion,prefer-numeric-literals,use-isnan,radix, and others
No breaking changes or core API removals are documented for this release.
Relevant overlap with this repo:
| Changed rule | Used here? | Expected impact |
|---|---|---|
eqeqeq |
Yes — enabled via @duckduckgo/eslint-config with { null: "ignore" } |
Bug fixes only; should reduce false positives (e.g. static template literals, null option edge cases) |
preserve-caught-error, max-nested-callbacks, radix, no-compare-neg-zero, etc. |
No — not in active config | No effect unless rules are added later |
Validation performed
- Ran
npm run lintlocally on 10.7.0 (afternpm run buildforlint-no-output-globals) — passes - Compared
eslint .JSON output between 10.6.0 and 10.7.0 — identical (6 issues, same rule counts) - CI on this PR: build, unit tests, and most integration tests already passing at review time
Test coverage
ESLint is dev-only tooling. Coverage is provided by the repo's npm run lint pipeline (ESLint + tsc + tsc-strict-core + Prettier + workspace lint scripts), which runs in CI. There are no separate unit tests for ESLint itself, which is appropriate for a linter bump.
Dependency necessity
ESLint remains required and appropriately used:
- Root
eslint.config.jscomposes@duckduckgo/eslint-config,typescript-eslint, andeslint-plugin-react-hooks lint/lint-fixare primary quality gates in CI
No alternative tooling in the repo supersedes this role.
Supply chain
| Check | Assessment |
|---|---|
| Package | Official eslint on npm registry |
| Maintainers | OpenJS Foundation (openjsfoundation), eslintbot |
| Publish date | 2026-07-10 (17 days before this PR) |
| Lockfile integrity | Updated SRI hash for eslint-10.7.0.tgz |
| Transitive changes | None in lockfile beyond the direct bump |
Confirmed: Low supply-chain concern for this update.
Informational (not blocking): eslint@10.8.0 is now latest on npm (2026-07-24). Dependabot may propose that separately; no action needed for this PR.
Fix PR
Checked open PRs — no existing fix PR is needed for this update. No separate fix branch will be opened.
Sent by Cursor Automation: Review dependabot
1 participant
Bumps the eslint group with 1 update: eslint.
Updates
eslintfrom 10.6.0 to 10.7.0Release notes
Sourced from eslint's releases.
Commits
fabd99b10.7.037c5e75Build: changelog update for 10.7.09489379chore: update dependency@eslint/eslintrcto ^3.3.6 (#21076)81a4774chore: updates for v9.39.5 release3e7bf15fix: applyignoreClassesWithImplementsto class expressions (#21069)9835414chore: enable$ExpectTypeannotations in all TypeScript files (#21071)cf2a9bffeat: add errorClassNames option to preserve-caught-error rule (#21032)c30d808docs: Update READMEf8b873afeat: max-nested-callbacks option for constructor callbacks (#21063)72adf6bchore: restrictmarkdownlint-cli2updates in renovate (#21067)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsNote
Low Risk
Dev-only dependency bump with no runtime or shipped bundle impact; minor ESLint rule fixes may surface new lint findings in CI only.
Overview
Bumps the root devDependency
eslintfrom 10.6.0 to 10.7.0 inpackage.jsonandpackage-lock.json. No application or workspace source changes.This is a routine Dependabot tooling update; CI
lintstill runs ESLint across the monorepo with the same@duckduckgo/eslint-configand related plugins.Reviewed by Cursor Bugbot for commit a882466. Bugbot is set up for automated code reviews on this repo. Configure here.