deps: bump @eslint/js from 9.39.2 to 10.0.1

[dependabot]

Bumps @eslint/js from 9.39.2 to 10.0.1.

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

• c87d5bd fix: update eslint (#20531) (renovate[bot])
• d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
• 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
• 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

• 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
• 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
• b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

• e5c281f chore: updates for v9.39.3 release (Jenkins)
• 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
• 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
• 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
• da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
• 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

• f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
• a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
• c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
• fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
• 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
• 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
• ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
• 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
• c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
• 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
• a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
• a89059d feat!: Program range span entire source text (#20133) (Pixel998)
• 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
• f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
• aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
• f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
• 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
• 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
• 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
• 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
• f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

• bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
• 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
• 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

• 84fb885 chore: package.json update for @​eslint/js release
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
• f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
• b4b3127 chore: package.json update for @​eslint/js release
• 0b14059 chore: package.json update for @​eslint/js release
• fa31a60 feat!: add name to configs (#20015)
• 1e2cad5 chore: package.json update for @​eslint/js release
• 454a292 feat!: update eslint:recommended configuration (#20210)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[robotlearning123]

Backlog-loop verification: FAILING, and not pre-existing.

Head bd1b7a20d8b0529b8e2fed090ebff1faa044f52a (dependabot/npm_and_yarn/eslint/js-10.0.1), base main ce7da5b151473a7c01b688d116284ba60056c5be.

Status. gh pr checks 56 reports 7 failing checks — Check Repository, Lint & Format, Scan Agent Readiness, Test (Node 20.x), Test (Node 22.x), Type Check, claude-review — with Build skipped and Validate PR passing. Six of the seven failures are introduced by this diff's own change; claude-review is a pre-existing repo-wide failure (see below).

Root cause (reproduced by execution, not inferred). This PR bumps @eslint/js to ^10.0.1 (package.json:78) while eslint stays ^9.17.0 (package.json:84). @eslint/js@10.0.1 declares peerDependencies: { "eslint": "^10.0.0" } (optional; package-lock.json:641-642), so npm cannot resolve the tree. npm ci on a copy of the exact head tree (npm 10.9.4, node v22.22.0) exits 1:

npm error Could not resolve dependency:
npm error peerOptional eslint@"^10.0.0" from @eslint/js@10.0.1
npm error node_modules/@eslint/js
npm error   dev @eslint/js@"^10.0.1" from the root project
npm error Conflicting peer dependency: eslint@10.11.0

Every failing job runs npm ci as its dependency-install step immediately after checkout — .github/workflows/ci.yml:27, :48, :71, :90 (lint, typecheck, test, build), .github/workflows/pr-check.yml:101 (Scan Agent Readiness of PR Check), and action.yml:38 (composite action used by the Check Repository job, .github/workflows/agent-ready.yml:17) — so each of them dies at install. Build is skipped because it declares needs: [lint, typecheck, test] (ci.yml:79).

Power demonstration — the failure is attributable to this PR, not to the environment. The identical command on the base tree exits 0 ("added 326 packages"), installing eslint 9.39.2 + @eslint/js 9.39.2. Base gates are green locally: lint exit 0 (0 errors, 1 pre-existing warning), format:check exit 0, typecheck exit 0, tests 57 pass / 0 fail. CI on sibling branches from the same base is green on the same gates: PR #54 (head 49d1a2d) passes Check Repository / Lint & Format / Scan Agent Readiness / Test (Node 20.x) / Test (Node 22.x) / Type Check / Build, and commit c447325 (branch chore/merge-satellites, PRs #74/#75; git merge-base --is-ancestor ce7da5b c447325 exits 0) passes them too. These checks can pass in this repo, so their failure here carries information.

Only pre-existing failure: claude-review. The Claude Code Review workflow fails repo-wide, independent of this diff: recent pull_request runs fail on chore/merge-satellites, merge/satellites, fix/agent-ready-pr71-baseline-20260922, docs/portfolio-agent-ready-v2-20260922-125500 and on the old dependabot/npm_and_yarn/qs-6.15.2 PR — including branches where CI / Agent Ready / PR Check are green. It is not counted against this PR.

Pairing: this cannot land without #54 (the open question in the backlog notes).

(a) The peer range above makes the tree unresolvable (npm ci exit 1).
(b) Forcing it with npm ci --legacy-peer-deps (exit 0 — not what CI runs) leaves the tree flagged broken: npm ls reports eslint@9.39.2 invalid: "^10.0.0" from node_modules/@eslint/js and exits with ELSPROBLEMS. The config source and the linter then sit on different majors: eslint.config.js:1 imports the root @eslint/js = 10.0.1 while npx eslint --version reports v9.39.2, and eslint nests its own @eslint/js@9.39.2 (package-lock.json:2100).
(c) PR #54 is the opposite half — eslint ^10.0.2 / @eslint/js ^9.17.0, resolving to eslint 10.0.2 + @eslint/js 9.39.2. eslint@10.0.2 declares no @eslint/js dependency and @eslint/js@9.39.2 declares no eslint peer, so #54 alone leaves the config source one major behind the linter. Neither PR alone yields a matched pair; the coherent sequence is #54 first (or this rebased onto #54), with the lockfile regenerated.

Independent review findings (verdict: REQUEST_CHANGES; every file:line below was re-read at the pinned head).

1. package.json:78, :84, package-lock.json:31, :641 — the peer-range mismatch above; this change must ride with deps: bump eslint from 9.39.2 to 10.0.2 #54.
2. package.json:94 + package-lock.json:636 — @eslint/js@10.0.1 requires node ^20.19.0 || ^22.13.0 || >=24 (the same floor ESLint 10 documents) while engines.node remains >=20.0.0, which admits 20.0–20.18, 21 and 23. Raise engines in the same change.
3. Lockfile scope is wider than the version bump: besides @eslint/js 9.39.2 → 10.0.1, the lockfile flips "peer": true on packages whose versions did not change — added on hono@4.11.5 (package-lock.json:2665), removed on @opentelemetry/api, @typescript-eslint/parser, acorn, eslint, express, tinyglobby/node_modules/picomatch, typescript, zod — and moves the lockfile root version 0.1.0 → 0.2.0 (package-lock.json:3, :9). That last one is a stale-field resync rather than a new inconsistency: package.json already said 0.2.0 at the base.
4. No test asserts that @eslint/js and eslint resolve to the same major, and the existing gate cannot catch a recurrence because npm ci fails before lint ever runs.

Secondary, informational. With the legacy-forced install the code itself is clean — lint 0 errors (1 pre-existing warning at test/e2e/cli.e2e.test.ts:21), format:check 0, typecheck 0, tests 57/57 — so the breakage is dependency resolution, not lint semantics. The @eslint/js recommended rule set grows 61 → 64 entries from 9.39.2 to 10.0.1, adding exactly no-unassigned-vars, no-useless-assignment, preserve-caught-error.

Caveats. (1) CI job logs are no longer retrievable (gh run view --log-failed → HTTP 410), so per-job CI stderr could not be quoted; the causal chain rests on job status, the workflow definitions, and local reproduction of the identical npm ci. (2) The Test (Node 20.x) matrix leg was reproduced on the locally available Node v22.22.0 only.

Recommendation (maintainer decision). Do not merge as-is. Land #54 first and rebase/regenerate this on top, or close this and let one combined bump carry both. #54 itself carries the same engines gap (finding 2), so this is an owner call rather than an agent call.