chore(deps-dev): bump eslint from 9.39.2 to 10.0.2 by dependabot[bot] · Pull Request #1529 · Chia-Network/cadt

dependabot · 2026-03-12T18:39:27Z

Bumps eslint from 9.39.2 to 10.0.2.

Release notes

v10.0.2

Bug Fixes

2b72361 fix: update ajv to 6.14.0 to address security vulnerabilities (#20537) (루밀LuMir)

Documentation

13eeedb docs: link rule type explanation to CLI option --fix-type (#20548) (Mike McCready)

98cbf6b docs: update migration guide per Program range change (#20534) (Huáng Jùnliàng)

61a2405 docs: add missing semicolon in vars-on-top rule example (#20533) (Abilash)

Chores

951223b chore: update dependency @eslint/eslintrc to ^3.3.4 (#20553) (renovate[bot])

6aa1afe chore: update dependency eslint-plugin-jsdoc to ^62.7.0 (#20536) (Milos Djermanovic)

v10.0.1

Bug Fixes

c87d5bd fix: update eslint (#20531) (renovate[bot])

d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)

04c2147 fix: update error message for unused suppressions (#20496) (fnx)

38b089c fix: update dependency @eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)

6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)

b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

e5c281f chore: updates for v9.39.3 release (Jenkins)

8c3832a chore: update @typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)

8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)

37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)

da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)

84fb885 chore: package.json update for @eslint/js release (Jenkins)

1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)

a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)

c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)

fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)

3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)

501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])

ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)

96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)

c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)

208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)

a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)

a89059d feat!: Program range span entire source text (#20133) (Pixel998)

39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)

f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)

... (truncated)

Commits

55122d6 10.0.2
80f1e29 Build: changelog update for 10.0.2
951223b chore: update dependency @eslint/eslintrc to ^3.3.4 (#20553)
13eeedb docs: link rule type explanation to CLI option --fix-type (#20548)
6aa1afe chore: update dependency eslint-plugin-jsdoc to ^62.7.0 (#20536)
2b72361 fix: update ajv to 6.14.0 to address security vulnerabilities (#20537)
98cbf6b docs: update migration guide per Program range change (#20534)
61a2405 docs: add missing semicolon in vars-on-top rule example (#20533)
0bd5497 10.0.1
ddb80ef Build: changelog update for 10.0.1
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Low Risk
Low risk dev-tooling update; main impact is potential lint/CI behavior changes from ESLint v10 and its updated dependency tree.

Overview
Updates eslint from 9.39.2 to 10.0.2 in package.json.

Regenerates package-lock.json for the ESLint v10 dependency graph, including updates like newer @eslint/* packages, ajv, espree, and minimatch (and associated adds/removals such as dropping lodash.merge).

^{Written by Cursor Bugbot for commit 9af49d4. This will update automatically on new commits. Configure here.}

Bumps [eslint](https://github.com/eslint/eslint) from 9.39.2 to 10.0.2. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.2...v10.0.2) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-03-12T18:40:27Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint@9.39.2 ⏵ 10.0.2	⁺¹

View full report

socket-security · 2026-03-12T18:40:29Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code augments a meta-schema to permit remote dereferencing of keyword schemas via a hardcoded data.json resource. This introduces network dependency and potential changes to validation semantics at runtime. While not inherently malicious, the remote reference constitutes a notable security and reliability risk that should be mitigated with local fallbacks, input validation, and explicit remote-resource governance. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/eslint@10.0.2` → `npm/ajv@6.14.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@6.14.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ajv` is 100.0% likely to have a medium risk anomaly Notes: The code is a straightforward build script to bundle and minify a specified package using Browserify and UglifyJS. The primary security concern is potential path manipulation: json.main is used to form a require path without validating that it stays within the target package directory. If a malicious or misconfigured package.json includes an absolute path or traversal outside the package, the script could bundle unintended files. Otherwise, the script does not perform network access, data exfiltration, or backdoor actions, and there is no hard-coded secrets or dynamic code execution beyond standard bundling/minification. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/eslint@10.0.2` → `npm/ajv@6.14.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ajv@6.14.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

cursor · 2026-03-12T18:42:12Z

package.json

    "chai-http": "^5.1.2",
    "cross-env": "^10.1.0",
-    "eslint": "^9.39.2",
+    "eslint": "^10.0.2",


@eslint/js v9 not updated for eslint v10 compatibility

High Severity

eslint was bumped to ^10.0.2 but @eslint/js remains at ^9.39.2. In eslint v9, @eslint/js was bundled as a direct dependency of eslint. In v10, it's no longer bundled — the project's own @eslint/js is used directly. The eslint.config.mjs imports @eslint/js and uses js.configs.recommended, which in v9 won't include the new v10 recommended rules (preserve-caught-error, no-useless-assignment, no-unassigned-vars). The @eslint/js package needs to be bumped to v10 to match the eslint major version.

Additional Locations (1)

package.json#L107-L108

cursor · 2026-03-12T18:42:12Z

package.json

    "chai-http": "^5.1.2",
    "cross-env": "^10.1.0",
-    "eslint": "^9.39.2",
+    "eslint": "^10.0.2",


@babel/eslint-parser peer dependency excludes eslint v10

High Severity

@babel/eslint-parser v7.28.6 declares peerDependencies of eslint: "^7.5.0 || ^8.0.0 || ^9.0.0", which does not include eslint v10. The project's eslint.config.mjs uses babelParser as its parser. Since eslint v10 removed deprecated SourceCode methods and rule context methods, the parser may break at runtime. This peer dependency needs a compatible update before eslint can be safely bumped to v10.

Additional Locations (1)

package-lock.json#L183-L186

dependabot bot added Changed Required label for PR that categorizes merge commit message as "Changed" for changelog dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 12, 2026

dependabot bot mentioned this pull request Mar 12, 2026

build(deps-dev): bump eslint from 9.39.2 to 10.0.0 #1498

Closed

cursor bot reviewed Mar 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps-dev): bump eslint from 9.39.2 to 10.0.2#1529

chore(deps-dev): bump eslint from 9.39.2 to 10.0.2#1529
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/npm_and_yarn/eslint-10.0.2

dependabot bot commented on behalf of github Mar 12, 2026 •

edited by cursor bot

Loading

Uh oh!

socket-security bot commented Mar 12, 2026

Uh oh!

socket-security bot commented Mar 12, 2026

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Mar 12, 2026

Uh oh!

cursor bot Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 12, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v10.0.2

Bug Fixes

Documentation

Chores

v10.0.1

Bug Fixes

Documentation

Chores

v10.0.0

Breaking Changes

Uh oh!

socket-security bot commented Mar 12, 2026

Uh oh!

socket-security bot commented Mar 12, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 12, 2026

Choose a reason for hiding this comment

@eslint/js v9 not updated for eslint v10 compatibility

Uh oh!

cursor bot Mar 12, 2026

Choose a reason for hiding this comment

@babel/eslint-parser peer dependency excludes eslint v10

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Mar 12, 2026 •

edited by cursor bot

Loading

`@eslint/js` v9 not updated for eslint v10 compatibility

`@babel/eslint-parser` peer dependency excludes eslint v10