build(deps): bump brace-expansion and eslint in /V0/workbench#341
build(deps): bump brace-expansion and eslint in /V0/workbench#341dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) to 5.0.7 and updates ancestor dependency [eslint](https://github.com/eslint/eslint). These dependencies need to be updated together. Updates `brace-expansion` from 5.0.3 to 5.0.7 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.3...v5.0.7) Updates `eslint` from 9.39.3 to 10.7.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.3...v10.7.0) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.7 dependency-type: indirect - dependency-name: eslint dependency-version: 10.7.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 09c8a8a. Configure here.
| "@types/react-dom": "^18.3.0", | ||
| "@vitejs/plugin-react-swc": "^4.3.1", | ||
| "eslint": "^9.9.0", | ||
| "eslint": "^10.7.0", |
There was a problem hiding this comment.
React hooks ESLint peer mismatch
Medium Severity
Bumping eslint to ^10.7.0 leaves eslint-plugin-react-hooks at ^5.1.0-rc.0, which resolves to 5.2.0 and declares peer support only through ESLint 9. The lockfile therefore pairs ESLint 10 with a plugin that does not accept that major, so npm run lint can fail on install (strict peers) or when loading the hooks plugin under ESLint 10.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 09c8a8a. Configure here.
Bumps brace-expansion to 5.0.7 and updates ancestor dependency eslint. These dependencies need to be updated together.
Updates
brace-expansionfrom 5.0.3 to 5.0.7Commits
b735ba65.0.7c7e33ecMerge commit from forkfa1786aBump tar from 7.5.11 to 7.5.16 (#116)c16f1ecfix(package.json): use git+https instead of git+ssh for repository URL (#115)196bbccBump ip-address from 10.1.0 to 10.2.0 (#104)eb18dd6Update ci.yml (#107)a39928dBump minimatch (#106)7950ae3ci: correct test workflow (#105)46317b55.0.6c0b095bMerge commit from forkUpdates
eslintfrom 9.39.3 to 10.7.0Release notes
Sourced from eslint's releases.
... (truncated)
Commits
fabd99b10.7.037c5e75Build: changelog update for 10.7.09489379chore: update dependency@eslint/eslintrcto ^3.3.6 (#21076)81a4774chore: updates for v9.39.5 release3e7bf15fix: applyignoreClassesWithImplementsto class expressions (#21069)9835414chore: enable$ExpectTypeannotations in all TypeScript files (#21071)cf2a9bffeat: add errorClassNames option to preserve-caught-error rule (#21032)c30d808docs: Update READMEf8b873afeat: max-nested-callbacks option for constructor callbacks (#21063)72adf6bchore: restrictmarkdownlint-cli2updates in renovate (#21067)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Dev-only dependency bump with no runtime or app logic changes; main risk is ESLint 10 / Node engine mismatch or lint rule behavior differences until
npm run lintis verified.Overview
Bumps dev tooling only in
V0/workbench:eslintgoes from ^9.9.0 to ^10.7.0 inpackage.json, with the lockfile refreshed for the new ESLint 10 dependency tree.The lockfile shift is mostly transitive: newer
@eslint/*packages, espree / eslint-scope / eslint-visitor-keys, and minimatch / brace-expansion (including 5.0.7). ESLint 10’s resolved tree also drops some v9-era packages (e.g.@eslint/eslintrc, chalk-related deps) and tightens Node to^20.19.0 || ^22.13.0 || >=24for the core linter.No app source or ESLint config files are changed in this diff—only
package.jsonandpackage-lock.json. Worth confirmingnpm run lintand that CI Node versions meet ESLint 10’s engine requirement.Reviewed by Cursor Bugbot for commit 09c8a8a. Bugbot is set up for automated code reviews on this repo. Configure here.