Skip to content

Support ESLint version 10 (fixes #92)#91

Open
Standard8 wants to merge 1 commit into
microsoft:mainfrom
Standard8:eslint-10
Open

Support ESLint version 10 (fixes #92)#91
Standard8 wants to merge 1 commit into
microsoft:mainfrom
Standard8:eslint-10

Conversation

@Standard8

@Standard8 Standard8 commented Feb 8, 2026

Copy link
Copy Markdown

Generally upgrade the dependencies. The only change for ESLint 10 is to drop the type option for errors in RuleTester, as the option is no longer supported (fixes #92)

Generally upgrade the dependencies. The only change for ESLint 10 is to drop the
type option for errors in RuleTester, as the option is no longer supported
@Standard8
Standard8 requested a review from a team as a code owner February 8, 2026 20:07
@Standard8

Copy link
Copy Markdown
Author

@microsoft-github-policy-service agree company="Mozilla Corporation"

@Standard8

Copy link
Copy Markdown
Author

The test error here appears to be the same issue as on main.

@Standard8 Standard8 changed the title Support ESLint version 10 Support ESLint version 10 (fixes #92) Feb 24, 2026
@romanresh

Copy link
Copy Markdown

We're also waiting for merge of this PR.

@Standard8

Copy link
Copy Markdown
Author

@mkacmar Is this still supported? Would we be able to get this into a new release?

@mozfreddyb

Copy link
Copy Markdown
Contributor

@A-Katopodis Can you help us out here?

@Standard8

Copy link
Copy Markdown
Author

@mkacmar @A-Katopodis Is there anything we can do to help this along, or should we consider this abandoned & obsolete it now?

It'd be useful to get a clear picture on the support for this for an ongoing basis.

mrkanitkar added a commit to mrkanitkar/playwright-praman that referenced this pull request May 25, 2026
## Summary
Upgrades ESLint from 9.x to 10.x — previously deferred because
`@microsoft/eslint-plugin-sdl` declares `peerDep: eslint ^9`.

**Investigation found the blocker is soft-only:**
- SDL plugin uses only modern ESLint APIs (`context.sourceCode`,
`context.options`) — none of the deprecated APIs ESLint 10 removed
- Plugin works correctly at runtime; only the peerDep declaration is
outdated
- Microsoft hasn't updated the plugin since Feb 2025; community PR
[microsoft/eslint-plugin-sdl#91](microsoft/eslint-plugin-sdl#91)
confirms only peerDep needs changing
- Resolved via npm `overrides` — standard, safe, removable when SDL
publishes an update

### Package changes
| Package | From | To | Notes |
|---------|------|----|-------|
| `eslint` | 9.39.2 | 10.4.0 | Major — eslintrc fully removed (we use
flat config) |
| `@eslint/js` | 9.39.3 | 10.0.1 | Must match eslint major |
| `eslint-plugin-n` | 17.24.0 | 18.0.1 | Major, peerDep `>=8.57.1` |
| `eslint-plugin-security` | 3.0.1 | 4.0.0 | Major, no eslint peerDep |
| `eslint-plugin-promise` | 7.2.1 | 7.3.0 | Minor — needed for `eslint
^10` peerDep |
| `@microsoft/eslint-plugin-sdl` | 1.1.0 | 1.1.0 | Unchanged, override
handles peerDep |

### SDL plugin usage (9 rules, all unique)
`no-insecure-url`, `no-cookies`, `no-document-write`, `no-inner-html`,
`no-msapp-exec-unsafe`, `no-postmessage-star-origin`,
`no-winjs-html-unsafe`, `no-html-method`, `no-angular-bypass-sanitizer`
— none overlap with eslint-plugin-security or sonarjs.

## Test plan
- [x] `npm run ci` passes (lint, typecheck, 4460 unit tests, build,
capabilities)
- [x] `npm run lint:ui5-deprecated` passes (custom praman rules work
under ESLint 10)
- [x] Pre-commit hooks work (lint-staged + commitlint)
- [x] Pre-push hooks pass (spellcheck, coverage, build)
- [ ] CI matrix (ubuntu, windows, macos) passes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: maheshwar kanitkar <maheshwar@Aparnas-MacBook-Air.fritz.box>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
mrkanitkar added a commit to mrkanitkar/playwright-praman that referenced this pull request May 30, 2026
## Summary
Upgrades ESLint from 9.x to 10.x — previously deferred because
`@microsoft/eslint-plugin-sdl` declares `peerDep: eslint ^9`.

**Investigation found the blocker is soft-only:**
- SDL plugin uses only modern ESLint APIs (`context.sourceCode`,
`context.options`) — none of the deprecated APIs ESLint 10 removed
- Plugin works correctly at runtime; only the peerDep declaration is
outdated
- Microsoft hasn't updated the plugin since Feb 2025; community PR
[microsoft/eslint-plugin-sdl#91](microsoft/eslint-plugin-sdl#91)
confirms only peerDep needs changing
- Resolved via npm `overrides` — standard, safe, removable when SDL
publishes an update

### Package changes
| Package | From | To | Notes |
|---------|------|----|-------|
| `eslint` | 9.39.2 | 10.4.0 | Major — eslintrc fully removed (we use
flat config) |
| `@eslint/js` | 9.39.3 | 10.0.1 | Must match eslint major |
| `eslint-plugin-n` | 17.24.0 | 18.0.1 | Major, peerDep `>=8.57.1` |
| `eslint-plugin-security` | 3.0.1 | 4.0.0 | Major, no eslint peerDep |
| `eslint-plugin-promise` | 7.2.1 | 7.3.0 | Minor — needed for `eslint
^10` peerDep |
| `@microsoft/eslint-plugin-sdl` | 1.1.0 | 1.1.0 | Unchanged, override
handles peerDep |

### SDL plugin usage (9 rules, all unique)
`no-insecure-url`, `no-cookies`, `no-document-write`, `no-inner-html`,
`no-msapp-exec-unsafe`, `no-postmessage-star-origin`,
`no-winjs-html-unsafe`, `no-html-method`, `no-angular-bypass-sanitizer`
— none overlap with eslint-plugin-security or sonarjs.

## Test plan
- [x] `npm run ci` passes (lint, typecheck, 4460 unit tests, build,
capabilities)
- [x] `npm run lint:ui5-deprecated` passes (custom praman rules work
under ESLint 10)
- [x] Pre-commit hooks work (lint-staged + commitlint)
- [x] Pre-push hooks pass (spellcheck, coverage, build)
- [ ] CI matrix (ubuntu, windows, macos) passes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: maheshwar kanitkar <maheshwar@Aparnas-MacBook-Air.fritz.box>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@BearCooder

BearCooder commented Jul 23, 2026

Copy link
Copy Markdown

Hey @plade I saw that you rewieved the other PR recently and approved. Could you help us out here with a review to land eslint 10 support soon?
This is getting increasingly urgent as ESLint 9.x goes EOL on August 6th,

Thanks

@plade plade left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deleted this comment and replaced with inline review comment.

@plade plade left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ESLint 10 compatibility review

Comment thread package.json
},
"peerDependencies": {
"eslint": "^9"
"eslint": "^9 || ^10"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ESLint 10 support is incomplete with the current dependency graph. Please address these items before advertising ^10 here:

  1. Upgrade @typescript-eslint/eslint-plugin and @typescript-eslint/parser together to a current v8 release whose peer range includes ESLint 10 (for example, ^8.65.0). Since config/typescript.js loads these packages from the exported configuration, move them from devDependencies to dependencies unless TypeScript support is redesigned as an optional peer feature.

  2. Remove eslint-plugin-react@7.37.5; its peer range ends at ESLint 9, so a clean ESLint 10 consumer install can fail with ERESOLVE. The React preset uses only no-danger, jsx-no-target-blank, and iframe-missing-sandbox. For dual ESLint 9/10 support, SDL-owned equivalents avoid retaining an incompatible dependency. @eslint-react/eslint-plugin has equivalents for the latter two, but its current ESLint/Node minimums would drop ESLint 9 and Node 20 support.

  3. Pass the parser object in the flat config instead of the package-name string:

const parser = require("@typescript-eslint/parser");

languageOptions: {
  parser,
  parserOptions: {
    ecmaVersion: 6,
    sourceType: "module"
  }
}
  1. Add CI coverage for ESLint 9 and 10. ESLint 10 jobs must use Node >=20.19. Include a clean consumer installation and execute configs.recommended against JS, JSX, TS, and TSX fixtures.

  2. Remove continue-on-error: true from the E2E ESLint step so plugin-load failures and rule crashes fail the workflow.

After these changes, "eslint": "^9.0.0 || ^10.0.0" is appropriate. Run ESLint's migration codemod as a starting point:

npx codemod @eslint/v9-to-v10

Sources:

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd be willing to update this IF I can get commitment that it is actually going to get accepted and released. 6 months of pinging people and not getting a response is not acceptable. I'm strongly considering just forking the bits we need so that we don't have this hassle every time TypeScript updates.

1. Upgrade `@typescript-eslint/eslint-plugin` and `@typescript-eslint/parser` together to a current v8 release whose peer range includes ESLint 10 (for example, `^8.65.0`). Since `config/typescript.js` loads these packages from the exported configuration, move them from `devDependencies` to `dependencies` unless TypeScript support is redesigned as an optional peer feature.

I could move these to be an optional peer dependency.

2. Remove `eslint-plugin-react@7.37.5`; its peer range ends at ESLint 9, so a clean ESLint 10 consumer install can fail with `ERESOLVE`. The React preset uses only `no-danger`, `jsx-no-target-blank`, and `iframe-missing-sandbox`. For dual ESLint 9/10 support, SDL-owned equivalents avoid retaining an incompatible dependency. `@eslint-react/eslint-plugin` has equivalents for the latter two, but its current ESLint/Node minimums would drop ESLint 9 and Node 20 support.

Maybe also an optional peer dependency, which would then mean that the React option wouldn't work until eslint-plugin-react upgrades, but there's not much we can do about that.

4. Add CI coverage for ESLint 9 and 10. ESLint 10 jobs must use Node >=20.19. Include a clean consumer installation and execute `configs.recommended` against JS, JSX, TS, and TSX fixtures.

As far as I can tell, we had no support for this previously (e.g. 8 -> 9), and there's no current infrastructure. I'm not going to work on this. ESLint 9 is stable and it is less likely to be broken since it has basically the same API as ESLint 10.

5. Remove `continue-on-error: true` from the E2E ESLint step so plugin-load failures and rule crashes fail the workflow.

This seems unrelated to making things work with ESLint 10.

After these changes, "eslint": "^9.0.0 || ^10.0.0" is appropriate. Run ESLint's migration codemod as a starting point:

Why? The major parts were already tested as being compatible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ESLint 10 compatibility request for @microsoft/eslint-plugin-sdl

6 participants