chore(deps-dev): Bump eslint from 9.39.2 to 10.8.0 in /frontend

[dependabot]

Bumps eslint from 9.39.2 to 10.8.0.

Release notes

Sourced from eslint's releases.

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits

• 749dfed 10.8.0
• 4bd0d75 Build: changelog update for 10.8.0
• 4fbf46d test: pin webpack version to 5.108.4 (#21137)
• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
• 784dfbe docs: Clarify no-eq-null description (#21120)
• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
• eccbe7b test: add error locations to no-class-assign (#21123)
• 2fee9bb feat: export ConfigObject from eslint/config (#21082)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
• Additional commits viewable in compare view

[thinkbig1979]

Independently verified locally at 587c2e8 before merge, in the main tree (not a worktree, since this needs a real install).

Install under the supply-chain policy — pnpm install --frozen-lockfile in frontend/: ✓ Lockfile passes supply-chain policies (730 entries in 9.3s), exit 0. No policy change needed.

All five gates green, run from frontend/ against the binaries directly:

Gate	Result
./node_modules/.bin/eslint .	exit 0, no output
./node_modules/.bin/tsc -b	exit 0
./node_modules/.bin/vite build	exit 0, ✓ built in 10.43s
./node_modules/.bin/vitest run	exit 0 — 89 test files, 881 tests, all passing, matching the pre-bump baseline exactly
./node_modules/.bin/knip --no-progress	exit 0
pnpm audit --prod --audit-level=high	exit 0, No known vulnerabilities found

A 9→10 major with zero config changes and zero source changes was the outcome worth checking rather than assuming; flat-config and rule changes were the expected risk and none of them bit here.

The tree change is the interesting part, and it settles a separate open issue. eslint@10.8.0 drops @eslint/eslintrc entirely, and OBSERVED in the resulting lockfile:

• @eslint/eslintrc — gone, 0 lockfile entries, pnpm why returns nothing
• minimatch — only 10.2.6 remains; the 3.x chain is gone
• js-yaml — gone from the tree entirely
• ajv — 6.15.0 and 8.20.0 remain (6.15.0 is already above the patched floor)

@eslint/eslintrc had exactly one dependent (eslint), so removing eslint 9 removes it. That makes agent-os-724 — pinned at @eslint/eslintrc 3.3.3, filed to reach 3.3.6+ for the patched minimatch/js-yaml/ajv floors — moot rather than merely cheaper: its subject is no longer in the tree. Re-derived after this lands rather than taken on faith.

One advisory remains frontend-wide (GHSA-2v37-7h3g-55p8, nanoid), unchanged by this PR and blocked by the maturity floor, not by this bump.

🤖 Generated with Claude Code