Skip to content

Update linters (major) - #705

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-linters
Open

renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-linters

Conversation

@renovate

@renovate renovate Bot commented Oct 26, 2025 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
eslint (source) ^9.33.0 → ^10.0.0 age adoption passing confidence
eslint-plugin-unicorn ^61.0.0 → ^79.0.0 age adoption passing confidence

Release Notes

eslint/eslint (eslint)

v10.13.0

Compare Source

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#​21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#​21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#​21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#​21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#​21287) (lumir)

Chores

v10.12.0

Compare Source

Features

  • 4618052 feat: handle astral letters in new-cap (#​21357) (sary)
  • 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#​21340) (electrohyun)

Bug Fixes

  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#​21373) (Daniel Pinto)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#​21332) (xbinaryx)
  • efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#​21360) (lumir)
  • 93de066 fix: prefer-exponentiation-operator autofix for async function base (#​21322) (Vladimir Babin)
  • 02e34ff fix: add missing space after else in curly autofix (#​21355) (Pixel)
  • b14b8bc fix: correct id-length message for long private names (#​21348) (Pixel)
  • 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#​21335) (xbinaryx)
  • 686630e fix: no-loss-of-precision false positive with 0.e5 (#​21337) (sethamus)

Documentation

  • 67eb586 docs: Update README (GitHub Actions Bot)
  • 5370d7e docs: clarify one-var separateRequires matches any require() call (#​21192) (sethamus)
  • 8816c1d docs: Update README (GitHub Actions Bot)
  • 3d2e7ce docs: fix typo in no-unused-expressions documentation (#​21346) (bytedoe)

Chores

  • 152067f chore: update ecosystem plugins (#​21362) (ESLint Bot)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#​21376) (renovate[bot])
  • bfaea12 perf: cache normalized config globals per languageOptions (#​21364) (James Ross)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#​21369) (Francesco Trotta)
  • d166567 chore: update dependency prettier to v3.9.9 (#​21371) (renovate[bot])
  • 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#​21359) (renovate[bot])
  • 39d79ba chore: update github/codeql-action action to v4.38.1 (#​21354) (renovate[bot])
  • 182a6e9 chore: update dependency prettier to v3.9.8 (#​21352) (renovate[bot])
  • f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#​21339) (Jarren)
  • b95fb6c chore: update dependency prettier to v3.9.7 (#​21347) (renovate[bot])
  • 3782dd4 chore: update ecosystem plugins (#​21342) (ESLint Bot)

v10.11.0

Compare Source

Features

  • d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#​21271) (Pavel)
  • 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#​21316) (electrohyun)
  • d3dd47f feat: only exempt new-cap built-ins that reference the global (#​21290) (sethamus)

Bug Fixes

  • 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#​21311) (xbinaryx)
  • b684bb1 fix: make TimePass.parse optional in types and docs (#​21313) (ntnyq)
  • 26d11bc fix: don't report __proto__ properties in object-shorthand (#​21310) (xbinaryx)

Documentation

  • 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#​21312) (bytedoe)
  • 6c789ff docs: Update README (GitHub Actions Bot)
  • 5997825 docs: clarify preserve-caught-error known limitation (#​21294) (Akinyemi Toluwalase)

Chores

  • 520dd77 perf: Implement fast paths in critical areas (#​21210) (Nicholas C. Zakas)
  • 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#​21330) (Francesco Trotta)
  • 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#​21331) (renovate[bot])
  • 24310e3 chore: update ecosystem plugins (#​21324) (ESLint Bot)
  • 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#​21318) (dependabot[bot])
  • ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#​21221) (Nicholas C. Zakas)
  • c832660 chore: Upgrade Stylelint to the latest version in docs (#​21245) (Jung Hyeon Jun)
  • f9f88fc chore: update ecosystem plugins (#​21308) (ESLint Bot)
  • fc81076 ci: add more types integration tests (#​20395) (Nitin Kumar)

v10.10.0

Compare Source

Features

  • 264b434 feat: add d and v flags to no-unexpected-multiline (#​21305) (Gihyeon Jeong / 정기현)
  • c6cc6c5 feat: check Object.prototype property names in new-cap (#​21269) (crimsonjay0)
  • 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#​21260) (synthex-byte)

Bug Fixes

  • bb47dc6 fix: update dependency file-entry-cache to v11 (#​20801) (Milos Djermanovic)
  • 427ac0a fix: use format strings in debug calls (#​21247) (Francesco Trotta)
  • 9d81532 fix: support __proto__ in /* exported */ comments (#​21261) (sethamus)
  • 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#​21282) (김채영)
  • 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#​21275) (Pixel)
  • 9f4a364 fix: Ignore static imports in no-unreachable (#​21276) (Taha Kotil)

Documentation

  • 2417cad docs: Update README (GitHub Actions Bot)
  • 9cecb8a docs: document \c control letter escapes in no-control-regex (#​21286) (한국)
  • 8724829 docs: update compat table links (#​21263) (fnx)
  • 5634542 docs: Clarify eqeqeq suggestion behavior (#​21256) (Müslüm Yılmaz)

Chores

v10.9.1

Compare Source

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#​21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#​21248) (Francesco Trotta)

Chores

v10.9.0

Compare Source

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#​21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#​21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#​21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#​21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#​21207) (김채영)

Documentation

  • 9ef407a docs: use eslint.config.* wherever config file names are listed (#​21216) (Marry (Subin Yang))
  • 87f66f4 docs: Update README (GitHub Actions Bot)
  • 585ef37 docs: update architecture documentation (#​21112) (Francesco Trotta)
  • f3993b0 docs: Update README (GitHub Actions Bot)
  • ffc87d6 docs: fix broken links in Further Reading sections (#​21203) (Minsu)
  • 1a761e1 docs: update moved JSX specification links (#​21198) (Imran Mustafa)
  • 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#​21202) (lumir)
  • 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

v10.8.1

Compare Source

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

v10.8.0

Compare Source

Features

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)

v10.7.0

Compare Source

Features

  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#​21032) (sethamus)
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#​21063) (fnx)
  • 557fde8 feat: support computed Number.parseInt member access in radix rule (#​21041) (Pixel)
  • 0b4a73b feat: add suggestions to no-compare-neg-zero (#​21034) (den$)
  • 96cdd42 feat: report invalid signed numeric radix values in radix rule (#​21030) (Pixel)

Bug Fixes

  • 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#​21069) (Pixel)
  • 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#​21062) (Mahin Anowar)
  • 75ec753 fix: handle static template literals in eqeqeq rule (#​21058) (Pixel)
  • b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#​21057) (Pixel)
  • e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#​21051) (Pixel)
  • a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#​21050) (Pixel)
  • d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#​21045) (spokodev)
  • 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#​21047) (한국)
  • a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#​20958) (sethamus)
  • 8a240a7 fix: avoid false positives in radix rule for spread arguments (#​21044) (Pixel)

Documentation

  • c30d808 docs: Update README (GitHub Actions Bot)
  • 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#​20980) (Alex Bit)
  • 04174cb docs: Update README (GitHub Actions Bot)
  • 026e130 docs: update semver policy for bug fixes (#​21048) (Milos Djermanovic)
  • 9d42fef docs: Update README (GitHub Actions Bot)
  • b230159 docs: Update README (GitHub Actions Bot)
  • 0129972 docs: correct **/.js glob to **/*.js in config files guide (#​21036) (EduardF1)

Chores

v10.6.0

Compare Source

Features

  • b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#​20981) (Taejin Kim)
  • f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#​20948) (sethamus)

Bug Fixes

  • 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#​20997) (Milos Djermanovic)
  • bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#​21013) (den$)
  • 8fd8741 fix: don't report shadowed undefined in radix rule (#​21011) (Pixel)
  • 5784980 fix: don't report shadowed undefined in no-throw-literal (#​21010) (Pixel)
  • 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#​21008) (Pixel)
  • d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#​21006) (Pixel)
  • 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#​21003) (den$)
  • 63d52d2 fix: restore max-classes-per-file report range (#​21002) (Pixel)
  • 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#​20979) (fnx)
  • 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#​20995) (Milos Djermanovic)

Documentation

  • a83683d docs: Update README (GitHub Actions Bot)
  • f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#​20986) (playgirl)
  • bea49f7 docs: Update README (GitHub Actions Bot)
  • e5f70f9 docs: update code-path diagrams (#​20984) (Tanuj Kanti)
  • 8890c2d docs: add TypeScript config guidance for MCP server (#​20796) (Pierluigi Lenoci)
  • 3eb3d9b docs: Update README (GitHub Actions Bot)
  • c5bb59c docs: Update README (GitHub Actions Bot)
  • eb3c97c docs: fix grammar in prefer-const rule description (#​20983) (lumir)

Chores

  • 6a42034 ci: run ecosystem tests on main branch (#​20891) (sethamus)
  • [3dbacdb

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner October 26, 2025 09:06
@coderabbitai

coderabbitai Bot commented Oct 26, 2025 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c3f32680-7ef9-43e6-b59b-e48620b75207

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/major-linters
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented Oct 26, 2025 •

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
Potential code anomaly (AI signal): npm ajv is 61.0% likely to have a medium risk anomaly

Notes: The code augments a meta-schema to permit remote dereferencing of keyword schemas via a hardcoded data.json resource. This introduces network dependency and potential changes to validation semantics at runtime. While not inherently malicious, the remote reference constitutes a notable security and reliability risk that should be mitigated with local fallbacks, input validation, and explicit remote-resource governance.

Confidence: 0.61

Severity: 0.60

From: yarn.lock → npm/eslint@10.13.0 → npm/ajv@6.15.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block
Low priority
Potential code anomaly (AI signal): npm ajv is 75.0% likely to have a medium risk anomaly

Notes: The code represents a conventional, non-obfuscated part of AJV’s custom keyword support. No direct malicious actions are evident within this module. Security concerns mainly arise from the broader supply chain: the external rule implementation (dotjs/custom), the definition schema, and any user-supplied keyword definitions. The dynamic compilation path (compile(metaSchema, true)) should be exercised with trusted inputs. Recommended follow-up: review the contents of the external modules and monitor the inputs supplied to addKeyword/definitionSchema to ensure no unsafe behavior is introduced during validation or data handling.

Confidence: 0.75

Severity: 0.55

From: yarn.lock → npm/eslint@10.13.0 → npm/ajv@6.15.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block
Low priority
Potential code anomaly (AI signal): npm ajv is 65.0% likely to have a medium risk anomaly

Notes: The code is a straightforward build script to bundle and minify a specified package using Browserify and UglifyJS. The primary security concern is potential path manipulation: json.main is used to form a require path without validating that it stays within the target package directory. If a malicious or misconfigured package.json includes an absolute path or traversal outside the package, the script could bundle unintended files. Otherwise, the script does not perform network access, data exfiltration, or backdoor actions, and there is no hard-coded secrets or dynamic code execution beyond standard bundling/minification.

Confidence: 0.65

Severity: 0.58

From: yarn.lock → npm/eslint@10.13.0 → npm/ajv@6.15.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block
Low priority
Potential code anomaly (AI signal): npm yaml is 68.0% likely to have a medium risk anomaly

Notes: The code presents a standard, non-malicious NodeBase component used in YAML/JS conversion. The primary risk surface is the optional reviver and onAnchor callbacks provided by the user: if untrusted, these can execute arbitrary code or influence the transformed representation via applyReviver or the reviver itself. This is expected behavior for extensible YAML libraries; ensure callbacks come from trusted sources and sandbox or validate revivers where possible.

Confidence: 0.68

Severity: 0.60

From: yarn.lock → npm/eslint-plugin-unicorn@79.0.0 → npm/yaml@2.9.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yaml@2.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block

View full report

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3d34a00 and 1fbdd51.

⛔ Files ignored due to path filters (1)
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (1)
  • package.json (1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (12)
  • GitHub Check: boostsecurity - boostsecurityio/semgrep-pro
  • GitHub Check: build (stylus, default)
  • GitHub Check: build (solidity, default)
  • GitHub Check: build (stellar, default)
  • GitHub Check: build (cairo, default)
  • GitHub Check: build (stellar, compile)
  • GitHub Check: ui
  • GitHub Check: mcp
  • GitHub Check: format-lint
  • GitHub Check: check
  • GitHub Check: deno-check
  • GitHub Check: semgrep-cloud-platform/scan

Comment thread package.json Outdated
"eslint-config-prettier": "^10.1.1",
"eslint-plugin-prettier": "^5.2.6",
"eslint-plugin-unicorn": "^61.0.0",
"eslint-plugin-unicorn": "^62.0.0",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Verify eslint-plugin-unicorn v62 breaking changes and config compatibility.

This is a major version bump (v61 → v62) for a linter plugin. Major version updates often introduce breaking changes, rule removals, or behavioral changes that may require eslint configuration updates or could cause lint failures.

Please verify:

  1. Whether v62.0.0 introduces breaking changes (check the release notes)
  2. Whether any eslint configuration updates are needed in .eslintrc files or linter configs
  3. Whether the lint script (eslint) will pass without errors with v62.0.0

If breaking changes exist, ensure that related configuration changes have been applied to the repository before merging.


🌐 Web query:

What are the breaking changes in eslint-plugin-unicorn v62.0.0 compared to v61?

💡 Result:

I couldn't find any release notes or a published v62.0.0 for eslint-plugin-unicorn. The official repo (sindresorhus/eslint-plugin-unicorn) and release listings don't show a v62 tag/releases, and the latest changelog I located is for v60.0.0. [1][2]

If you have a specific release URL or tag for v62 (or want me to keep searching other sources), share it and I’ll fetch the breaking changes and summarize them.

Sources:

  • eslint-plugin-unicorn GitHub repo. [1]
  • v60.0.0 changelog listing. [2]

🏁 Script executed:

#!/bin/bash
# Check the actual package.json content for eslint-plugin-unicorn version
cat package.json | grep -A2 -B2 "eslint-plugin-unicorn"

Length of output: 186


🏁 Script executed:

#!/bin/bash
# Query npm registry for eslint-plugin-unicorn versions (check latest and v62 specifically)
curl -s https://registry.npmjs.org/eslint-plugin-unicorn | jq '.versions | keys | sort | .[-10:]'

Length of output: 114


🏁 Script executed:

#!/bin/bash
# Check npm registry for v62 specifically
curl -s https://registry.npmjs.org/eslint-plugin-unicorn/62.0.0 | jq 'if .error then "Version not found" else .version end'

Length of output: 8



---

🏁 Script executed:

```shell
#!/bin/bash
# Find eslint configuration files in the repository
fd -t f -e json -e js -e yml -e yaml -e mjs -e cjs -g '*eslintrc*' .

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Also check for common eslint config locations
find . -maxdepth 2 -type f \( -name ".eslintrc*" -o -name "eslint.config.*" \) 2>/dev/null

Length of output: 19


🌐 Web query:

eslint-plugin-unicorn v62.0.0 changelog breaking changes

💡 Result:

There is no published eslint-plugin-unicorn v62.0.0 release. The latest published release series on npm/GitHub is v61 (most-recent tags show v61.x in Sep 2025), and npm's package page lists v60/v59 as recent stable releases. See the release list and npm info. [1][2]

Sources:

  • Release list for eslint-plugin-unicorn (shows up through v61.x). [1]
  • npm package page for eslint-plugin-unicorn (latest published versions). [2]

🏁 Script executed:

#!/bin/bash
# Check npm package metadata for v62.0.0 to see if it's a pre-release
curl -s https://registry.npmjs.org/eslint-plugin-unicorn/62.0.0 | jq '{version, dist_tags: .["dist-tags"], prerelease: (.version | contains("-")), published: .time["62.0.0"]}'

Length of output: 90


🏁 Script executed:

#!/bin/bash
# Check eslint.config.mjs to see which rules are configured
cat eslint.config.mjs

Length of output: 1348


Revert eslint-plugin-unicorn to stable v61 release; v62.0.0 is unreleased.

The version v62.0.0 exists on npm but is marked as unreleased (null published timestamp, no dist tags, not listed on GitHub releases). While the config imports eslint-plugin-unicorn, it doesn't explicitly enable any unicorn rules—so breaking changes wouldn't immediately break linting—using an unreleased, undocumented version introduces unnecessary stability risk.

Revert to the latest stable version: "eslint-plugin-unicorn": "^61.0.2"

🤖 Prompt for AI Agents
In package.json around line 37, the dependency "eslint-plugin-unicorn":
"^62.0.0" references an unreleased/unstable npm version; change it back to the
latest stable release by replacing the version string with "^61.0.2" so the
project uses the documented stable unicorn plugin; update package-lock/yarn.lock
by running the appropriate install command afterwards to ensure the lockfile
reflects the reverted version.

@renovate
renovate Bot force-pushed the renovate/major-linters branch 6 times, most recently from 006650e to 736220a Compare November 3, 2025 20:15
@renovate
renovate Bot force-pushed the renovate/major-linters branch 8 times, most recently from 190907f to b993a52 Compare November 11, 2025 20:36
@renovate
renovate Bot force-pushed the renovate/major-linters branch 5 times, most recently from d99213d to 94033eb Compare November 18, 2025 11:06
@renovate
renovate Bot force-pushed the renovate/major-linters branch 7 times, most recently from d465b3b to 4501d66 Compare December 1, 2025 18:54
@renovate
renovate Bot force-pushed the renovate/major-linters branch 6 times, most recently from 473b008 to 45f0ad6 Compare January 30, 2026 00:12
@renovate
renovate Bot force-pushed the renovate/major-linters branch 2 times, most recently from 0f1226a to 6a9cd57 Compare February 7, 2026 00:54
@renovate renovate Bot changed the title Update dependency eslint-plugin-unicorn to v62 Update linters (major) Feb 7, 2026
@renovate
renovate Bot force-pushed the renovate/major-linters branch 6 times, most recently from 0327e2f to 687a6ac Compare February 17, 2026 16:02
@renovate
renovate Bot force-pushed the renovate/major-linters branch 4 times, most recently from d83ed8d to acacd45 Compare February 23, 2026 23:13
@renovate
renovate Bot force-pushed the renovate/major-linters branch 3 times, most recently from 055e576 to 0017139 Compare February 26, 2026 13:42
@renovate
renovate Bot force-pushed the renovate/major-linters branch 2 times, most recently from e06adf9 to fe43d4c Compare March 7, 2026 01:09
@renovate
renovate Bot force-pushed the renovate/major-linters branch from fe43d4c to cc48d72 Compare March 13, 2026 13:50
@renovate
renovate Bot force-pushed the renovate/major-linters branch from cc48d72 to 448a3c9 Compare March 20, 2026 16:55
@renovate
renovate Bot force-pushed the renovate/major-linters branch 2 times, most recently from 6b9d996 to d67baa5 Compare March 30, 2026 21:49
@socket-security

socket-security Bot commented Apr 29, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​eslint-plugin-unicorn@​61.0.2 ⏵ 79.0.098100100 +196 +3100
Updatednpm/​eslint@​9.33.0 ⏵ 10.13.097 +110010097 +47100

View full report

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants