Align @eslint/js with ESLint 9 and pin the pair in Dependabot config

[henrymercer]

Summary

• change the direct @eslint/js range from ^10.0.1 to the latest 9.x, ^9.39.5, while keeping eslint at ^9.39.5
• regenerate the lockfile into a peer-clean graph with one deduplicated @eslint/js@9.39.5
• declaratively ignore major updates for both eslint and @eslint/js
• group major eslint and @eslint/js updates for when both packages are unpinned; minor and patch updates remain in the existing npm-minor group

This supersedes closed #1456 and is based directly on main without reusing that branch or history.

Context

The @eslint/js@^10.0.1 / eslint@^9.39.5 peer mismatch made clean lockfile regeneration impossible, while the frozen lockfile used by npm ci kept passing and hid the mismatch for roughly six weeks. #1372 merged @eslint/js 10.0.1 on June 22, 2026. #1424, which proposed ESLint 10.5.0, closed on June 23 after @dependabot ignore this major version, leaving only half of the pair upgraded.

ESLint 10 is deferred purely because eslint-plugin-github transitively depends on eslint-plugin-import and eslint-plugin-jsx-a11y, whose peer ranges exclude it. eslint-plugin-import@2.32.0 allows ^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9; eslint-plugin-jsx-a11y@6.10.2 allows ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9. npm can install ESLint 10 only by overriding those peers, and npm ls marks eslint@10.8.0 invalid.

This is not migration debt in this repository: the ESLint 10.8.0 investigation required no source or lint-configuration changes, produced zero lint violations, and passed all 44 tests. However, npm ci --dry-run --strict-peer-deps fails ERESOLVE immediately on eslint-plugin-import's range. The ESLint 10 route therefore breaks outright for strict-peer-deps users and remains exposed to any future npm default change; alignment is required for an honestly resolvable graph.

Registry inspection found no imminent support signal. eslint-plugin-import latest is 2.32.0 and its next tag is an obsolete 2.0 beta; eslint-plugin-jsx-a11y latest is 6.10.2 with no relevant prerelease; and eslint-plugin-github latest is 6.1.2, still depending on @eslint/js@^9.39.5, eslint-plugin-import@^2.31.0, and eslint-plugin-jsx-a11y@^6.10.2 with no relevant next release.

Dependabot guard

The eslint ignore previously existed only in invisible server-side Dependabot state. Dependabot reports that hidden condition exactly as [>= 10.a, < 11], so it covers ESLint 10.x only, not all future majors.

The declarative semver-major ignores in this PR are intentionally broader and symmetric. Without the declarative eslint rule, the 10-only server pin plus an all-major @eslint/js pin could eventually allow eslint@11 while @eslint/js remained frozen, mirroring the same half-upgrade trap. Both declarative ignores must be lifted together, and only once eslint-plugin-import and eslint-plugin-jsx-a11y support ESLint 10 through eslint-plugin-github; lifting only one recreates the mismatch.

GitHub's Dependabot options reference states that a dependency matching multiple groups is included in the first group it matches. The specific eslint group is therefore declared before the wildcard npm-minor group and covers major updates only. Minor and patch updates fall through to npm-minor. The ignores hold the line now; the dedicated group will pair eligible major updates once both packages are unpinned.

Validation

• npm registry confirmed 9.39.5 is the latest @eslint/js 9.x
• clean Node 24 npm install without force/legacy flags or ERESOLVE peer override warnings
• from-scratch Node 24 npm ci
• peer-clean npm ls with @eslint/js@9.39.5 deduplicated across ESLint and eslint-plugin-github
• npm run-script lint
• .github/workflows/script/check-js.sh
• .github/workflows/script/check-json-schemas.sh
• npm run-script find-deadcode
• all Vitest tests: 44 passed across 5 files

[Copilot]

Pull request overview

Aligns @eslint/js with ESLint 9 and regenerates the dependency graph.

Changes:

• Pins both ESLint packages to ^9.39.5.
• Deduplicates @eslint/js in the lockfile.
• Groups future Dependabot updates, though major updates can still become misaligned.

Show a summary per file

File	Description
package.json	Aligns the direct dependency version.
package-lock.json	Regenerates the peer-clean dependency graph.
.github/dependabot.yml	Groups ESLint dependency updates.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Balanced