Task
Pin eslint back to 9.39.4 in docs/docusaurus and regenerate that project's lockfile.
Why
PR #2519 bumps eslint to 10.8.0, but eslint-plugin-jsx-a11y@6.10.2 declares a peer range that stops at ^9. This makes npm ci fail with ERESOLVE in the "Docusaurus Unit Tests" check, before any test runs. 6.10.2 is the latest published release of that plugin, so there is no compatible version to upgrade into. Upstream tracking: jsx-eslint/eslint-plugin-jsx-a11y#1075
This change cannot be made locally because the contributor machine cannot reach https://registry.npmjs.org/, and the reachable internal mirror omits dist.integrity, which downgrades lockfile hashes to sha1 and fails npm run lint:public-dependency-feeds.
Scope
Branch: dependabot/npm_and_yarn/npm-dependencies-c586aca45b
Make exactly these changes:
- In
docs/docusaurus/package.json, set devDependencies.eslint to 9.39.4 (currently 10.8.0).
- Regenerate
docs/docusaurus/package-lock.json to match.
Suggested commands:
npm --prefix docs/docusaurus pkg set devDependencies.eslint=9.39.4
npm --prefix docs/docusaurus install --package-lock-only
Commit and push to the same branch. Do not open a new PR.
Do not change
- Any other dependency in
docs/docusaurus/package.json. The PR's other updates must stay exactly as they are: @docusaurus/* 3.10.2, react/react-dom 19.2.8, @testing-library/jest-dom 7.0.0, jest-axe 11.0.0, @playwright/test 1.62.0, @happy-dom/jest-environment 20.11.1, @typescript-eslint/parser 8.65.0, ts-jest 29.4.12, wait-on 9.1.0.
eslint-plugin-jsx-a11y — leave at 6.10.2.
- Root
package.json / package-lock.json.
evals/beval/**.
.github/dependabot.yml.
audit-ci.json.
- The
.npmrc files in docs/docusaurus/ and evals/beval/.
Acceptance criteria
docs/docusaurus/package.json shows "eslint": "9.39.4".
cd docs/docusaurus && npm ci completes without ERESOLVE.
cd docs/docusaurus && npm test passes.
npm run lint:public-dependency-feeds passes from the repository root.
- In
docs/docusaurus/package-lock.json, every integrity value starts with sha512- and every resolved URL points at registry.npmjs.org. No entry may reference pkgs.visualstudio.com, packagefeedproxy.microsoft.io, or any other non-public host.
git diff touches only docs/docusaurus/package.json and docs/docusaurus/package-lock.json.
Task
Pin
eslintback to9.39.4indocs/docusaurusand regenerate that project's lockfile.Why
PR #2519 bumps
eslintto10.8.0, buteslint-plugin-jsx-a11y@6.10.2declares a peer range that stops at^9. This makesnpm cifail withERESOLVEin the "Docusaurus Unit Tests" check, before any test runs.6.10.2is the latest published release of that plugin, so there is no compatible version to upgrade into. Upstream tracking: jsx-eslint/eslint-plugin-jsx-a11y#1075This change cannot be made locally because the contributor machine cannot reach
https://registry.npmjs.org/, and the reachable internal mirror omitsdist.integrity, which downgrades lockfile hashes tosha1and failsnpm run lint:public-dependency-feeds.Scope
Branch:
dependabot/npm_and_yarn/npm-dependencies-c586aca45bMake exactly these changes:
docs/docusaurus/package.json, setdevDependencies.eslintto9.39.4(currently10.8.0).docs/docusaurus/package-lock.jsonto match.Suggested commands:
npm --prefix docs/docusaurus pkg set devDependencies.eslint=9.39.4 npm --prefix docs/docusaurus install --package-lock-onlyCommit and push to the same branch. Do not open a new PR.
Do not change
docs/docusaurus/package.json. The PR's other updates must stay exactly as they are:@docusaurus/*3.10.2,react/react-dom19.2.8,@testing-library/jest-dom7.0.0,jest-axe11.0.0,@playwright/test1.62.0,@happy-dom/jest-environment20.11.1,@typescript-eslint/parser8.65.0,ts-jest29.4.12,wait-on9.1.0.eslint-plugin-jsx-a11y— leave at6.10.2.package.json/package-lock.json.evals/beval/**..github/dependabot.yml.audit-ci.json..npmrcfiles indocs/docusaurus/andevals/beval/.Acceptance criteria
docs/docusaurus/package.jsonshows"eslint": "9.39.4".cd docs/docusaurus && npm cicompletes withoutERESOLVE.cd docs/docusaurus && npm testpasses.npm run lint:public-dependency-feedspasses from the repository root.docs/docusaurus/package-lock.json, everyintegrityvalue starts withsha512-and everyresolvedURL points atregistry.npmjs.org. No entry may referencepkgs.visualstudio.com,packagefeedproxy.microsoft.io, or any other non-public host.git difftouches onlydocs/docusaurus/package.jsonanddocs/docusaurus/package-lock.json.