Support ESLint version 10 (fixes #92)#91
Conversation
Generally upgrade the dependencies. The only change for ESLint 10 is to drop the type option for errors in RuleTester, as the option is no longer supported
|
@microsoft-github-policy-service agree company="Mozilla Corporation" |
|
The test error here appears to be the same issue as on main. |
|
We're also waiting for merge of this PR. |
|
@mkacmar Is this still supported? Would we be able to get this into a new release? |
|
@A-Katopodis Can you help us out here? |
|
@mkacmar @A-Katopodis Is there anything we can do to help this along, or should we consider this abandoned & obsolete it now? It'd be useful to get a clear picture on the support for this for an ongoing basis. |
## Summary Upgrades ESLint from 9.x to 10.x — previously deferred because `@microsoft/eslint-plugin-sdl` declares `peerDep: eslint ^9`. **Investigation found the blocker is soft-only:** - SDL plugin uses only modern ESLint APIs (`context.sourceCode`, `context.options`) — none of the deprecated APIs ESLint 10 removed - Plugin works correctly at runtime; only the peerDep declaration is outdated - Microsoft hasn't updated the plugin since Feb 2025; community PR [microsoft/eslint-plugin-sdl#91](microsoft/eslint-plugin-sdl#91) confirms only peerDep needs changing - Resolved via npm `overrides` — standard, safe, removable when SDL publishes an update ### Package changes | Package | From | To | Notes | |---------|------|----|-------| | `eslint` | 9.39.2 | 10.4.0 | Major — eslintrc fully removed (we use flat config) | | `@eslint/js` | 9.39.3 | 10.0.1 | Must match eslint major | | `eslint-plugin-n` | 17.24.0 | 18.0.1 | Major, peerDep `>=8.57.1` | | `eslint-plugin-security` | 3.0.1 | 4.0.0 | Major, no eslint peerDep | | `eslint-plugin-promise` | 7.2.1 | 7.3.0 | Minor — needed for `eslint ^10` peerDep | | `@microsoft/eslint-plugin-sdl` | 1.1.0 | 1.1.0 | Unchanged, override handles peerDep | ### SDL plugin usage (9 rules, all unique) `no-insecure-url`, `no-cookies`, `no-document-write`, `no-inner-html`, `no-msapp-exec-unsafe`, `no-postmessage-star-origin`, `no-winjs-html-unsafe`, `no-html-method`, `no-angular-bypass-sanitizer` — none overlap with eslint-plugin-security or sonarjs. ## Test plan - [x] `npm run ci` passes (lint, typecheck, 4460 unit tests, build, capabilities) - [x] `npm run lint:ui5-deprecated` passes (custom praman rules work under ESLint 10) - [x] Pre-commit hooks work (lint-staged + commitlint) - [x] Pre-push hooks pass (spellcheck, coverage, build) - [ ] CI matrix (ubuntu, windows, macos) passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: maheshwar kanitkar <maheshwar@Aparnas-MacBook-Air.fritz.box> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
## Summary Upgrades ESLint from 9.x to 10.x — previously deferred because `@microsoft/eslint-plugin-sdl` declares `peerDep: eslint ^9`. **Investigation found the blocker is soft-only:** - SDL plugin uses only modern ESLint APIs (`context.sourceCode`, `context.options`) — none of the deprecated APIs ESLint 10 removed - Plugin works correctly at runtime; only the peerDep declaration is outdated - Microsoft hasn't updated the plugin since Feb 2025; community PR [microsoft/eslint-plugin-sdl#91](microsoft/eslint-plugin-sdl#91) confirms only peerDep needs changing - Resolved via npm `overrides` — standard, safe, removable when SDL publishes an update ### Package changes | Package | From | To | Notes | |---------|------|----|-------| | `eslint` | 9.39.2 | 10.4.0 | Major — eslintrc fully removed (we use flat config) | | `@eslint/js` | 9.39.3 | 10.0.1 | Must match eslint major | | `eslint-plugin-n` | 17.24.0 | 18.0.1 | Major, peerDep `>=8.57.1` | | `eslint-plugin-security` | 3.0.1 | 4.0.0 | Major, no eslint peerDep | | `eslint-plugin-promise` | 7.2.1 | 7.3.0 | Minor — needed for `eslint ^10` peerDep | | `@microsoft/eslint-plugin-sdl` | 1.1.0 | 1.1.0 | Unchanged, override handles peerDep | ### SDL plugin usage (9 rules, all unique) `no-insecure-url`, `no-cookies`, `no-document-write`, `no-inner-html`, `no-msapp-exec-unsafe`, `no-postmessage-star-origin`, `no-winjs-html-unsafe`, `no-html-method`, `no-angular-bypass-sanitizer` — none overlap with eslint-plugin-security or sonarjs. ## Test plan - [x] `npm run ci` passes (lint, typecheck, 4460 unit tests, build, capabilities) - [x] `npm run lint:ui5-deprecated` passes (custom praman rules work under ESLint 10) - [x] Pre-commit hooks work (lint-staged + commitlint) - [x] Pre-push hooks pass (spellcheck, coverage, build) - [ ] CI matrix (ubuntu, windows, macos) passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: maheshwar kanitkar <maheshwar@Aparnas-MacBook-Air.fritz.box> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
|
Hey @plade I saw that you rewieved the other PR recently and approved. Could you help us out here with a review to land eslint 10 support soon? Thanks |
| }, | ||
| "peerDependencies": { | ||
| "eslint": "^9" | ||
| "eslint": "^9 || ^10" |
There was a problem hiding this comment.
ESLint 10 support is incomplete with the current dependency graph. Please address these items before advertising ^10 here:
-
Upgrade
@typescript-eslint/eslint-pluginand@typescript-eslint/parsertogether to a current v8 release whose peer range includes ESLint 10 (for example,^8.65.0). Sinceconfig/typescript.jsloads these packages from the exported configuration, move them fromdevDependenciestodependenciesunless TypeScript support is redesigned as an optional peer feature. -
Remove
eslint-plugin-react@7.37.5; its peer range ends at ESLint 9, so a clean ESLint 10 consumer install can fail withERESOLVE. The React preset uses onlyno-danger,jsx-no-target-blank, andiframe-missing-sandbox. For dual ESLint 9/10 support, SDL-owned equivalents avoid retaining an incompatible dependency.@eslint-react/eslint-pluginhas equivalents for the latter two, but its current ESLint/Node minimums would drop ESLint 9 and Node 20 support. -
Pass the parser object in the flat config instead of the package-name string:
const parser = require("@typescript-eslint/parser");
languageOptions: {
parser,
parserOptions: {
ecmaVersion: 6,
sourceType: "module"
}
}-
Add CI coverage for ESLint 9 and 10. ESLint 10 jobs must use Node >=20.19. Include a clean consumer installation and execute
configs.recommendedagainst JS, JSX, TS, and TSX fixtures. -
Remove
continue-on-error: truefrom the E2E ESLint step so plugin-load failures and rule crashes fail the workflow.
After these changes, "eslint": "^9.0.0 || ^10.0.0" is appropriate. Run ESLint's migration codemod as a starting point:
npx codemod @eslint/v9-to-v10Sources:
There was a problem hiding this comment.
I'd be willing to update this IF I can get commitment that it is actually going to get accepted and released. 6 months of pinging people and not getting a response is not acceptable. I'm strongly considering just forking the bits we need so that we don't have this hassle every time TypeScript updates.
1. Upgrade `@typescript-eslint/eslint-plugin` and `@typescript-eslint/parser` together to a current v8 release whose peer range includes ESLint 10 (for example, `^8.65.0`). Since `config/typescript.js` loads these packages from the exported configuration, move them from `devDependencies` to `dependencies` unless TypeScript support is redesigned as an optional peer feature.
I could move these to be an optional peer dependency.
2. Remove `eslint-plugin-react@7.37.5`; its peer range ends at ESLint 9, so a clean ESLint 10 consumer install can fail with `ERESOLVE`. The React preset uses only `no-danger`, `jsx-no-target-blank`, and `iframe-missing-sandbox`. For dual ESLint 9/10 support, SDL-owned equivalents avoid retaining an incompatible dependency. `@eslint-react/eslint-plugin` has equivalents for the latter two, but its current ESLint/Node minimums would drop ESLint 9 and Node 20 support.
Maybe also an optional peer dependency, which would then mean that the React option wouldn't work until eslint-plugin-react upgrades, but there's not much we can do about that.
4. Add CI coverage for ESLint 9 and 10. ESLint 10 jobs must use Node >=20.19. Include a clean consumer installation and execute `configs.recommended` against JS, JSX, TS, and TSX fixtures.
As far as I can tell, we had no support for this previously (e.g. 8 -> 9), and there's no current infrastructure. I'm not going to work on this. ESLint 9 is stable and it is less likely to be broken since it has basically the same API as ESLint 10.
5. Remove `continue-on-error: true` from the E2E ESLint step so plugin-load failures and rule crashes fail the workflow.
This seems unrelated to making things work with ESLint 10.
After these changes,
"eslint": "^9.0.0 || ^10.0.0"is appropriate. Run ESLint's migration codemod as a starting point:
Why? The major parts were already tested as being compatible.
Generally upgrade the dependencies. The only change for ESLint 10 is to drop the type option for errors in RuleTester, as the option is no longer supported (fixes #92)