Skip to content

[Snyk] Security upgrade eslint from 8.57.0 to 10.0.0 - #3535

Open
JanCizmar wants to merge 1 commit into
mainfrom
snyk-fix-6b59b9bc0a9db3e4ae1e94a9c2052228
Open

JanCizmar wants to merge 1 commit into
mainfrom
snyk-fix-6b59b9bc0a9db3e4ae1e94a9c2052228

Conversation

@JanCizmar

Copy link
Copy Markdown
Member

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

  • e2e/package.json
⚠️ Warning
Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

Issue
high severity Allocation of Resources Without Limits or Throttling
SNYK-JS-JSYAML-19496768

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-JSYAML-19496768
@JanCizmar

Copy link
Copy Markdown
Member Author

Merge Risk: High

The upgrade from ESLint v8 to v10 is a high-risk migration involving two major versions with significant breaking changes. Manual intervention is required, primarily to adopt the new configuration format and update the Node.js runtime.

Key Breaking Changes

1. Mandatory Configuration Migration (v9 & v10):

  • New "Flat Config" Format: ESLint v9 introduced a new default configuration file, eslint.config.js ("flat config"), deprecating the traditional .eslintrc.* format.
  • .eslintrc Removed: ESLint v10 completely removes support for the legacy .eslintrc configuration system. Projects must migrate to eslint.config.js.

2. Node.js Version Requirements:

  • v9 Requirement: Dropped support for Node.js versions below 18.18.0.
  • v10 Requirement: Further increases the requirement, dropping support for Node.js versions below 20.19.0.

3. Removed Rules and Formatters (v9):

  • The core rules require-jsdoc and valid-jsdoc have been removed.
  • Several formatters were removed, including checkstyle, compact, junit, tap, and unix. Only stylish, html, json, and json-with-meta remain.

4. CLI and Rule Behavior Changes:

  • In v9, the --quiet flag no longer processes rules set to "warn".
  • In v10, JSX references are tracked more accurately, which may result in new linting errors in React/JSX codebases.

Recommendation:
This upgrade requires a planned migration effort. Developers must:

  1. Upgrade Node.js: Ensure the development and CI/CD environments are running Node.js v20.19.0 or newer.
  2. Migrate to Flat Config: Manually convert your .eslintrc.js or .eslintrc.json file to the new eslint.config.js format. You can use npx eslint --init for a new setup or follow the official migration guides.
  3. Verify Plugins: Ensure all ESLint plugins and parsers (e.g., for TypeScript, Vue, Prettier) are updated to versions compatible with ESLint v10 and its flat config system.

Sources: ESLint v9 Migration Guide, ESLint v10 Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@coderabbitai

coderabbitai Bot commented Sep 6, 2026

Copy link
Copy Markdown

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: d16574ac-ec05-4944-a32b-173ffff71b8c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants