microsoft / microsoft/hve-core

Pin eslint to 9.39.4 in docs/docusaurus and regenerate lockfile (PR #2519)

Open
#2,534 0 comments 2 reactions 2 assignees Claimed by @WilliamBerryiii View on GitHub
agent-ready build dependencies maintenance priority-2
Dominant language
Python
Stars
1.5k
Forks
301
Avg merge
3d 3h
Merged PRs (30d)
92

Description

## Task

Pin `eslint` back to `9.39.4` in `docs/docusaurus` and regenerate that project's lockfile.

## Why

PR #2519 bumps `eslint` to `10.8.0`, but `eslint-plugin-jsx-a11y@6.10.2` declares a peer range that stops at `^9`. This makes `npm ci` fail with `ERESOLVE` in the "Docusaurus Unit Tests" check, before any test runs. `6.10.2` is the latest published release of that plugin, so there is no compatible version to upgrade into. Upstream tracking: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/issues/1075

This change cannot be made locally because the contributor machine cannot reach `https://registry.npmjs.org/`, and the reachable internal mirror omits `dist.integrity`, which downgrades lockfile hashes to `sha1` and fails `npm run lint:public-dependency-feeds`.

## Scope

Branch: `dependabot/npm_and_yarn/npm-dependencies-c586aca45b`

Make exactly these changes:

1. In `docs/docusaurus/package.json`, set `devDependencies.eslint` to `9.39.4` (currently `10.8.0`).
2. Regenerate `docs/docusaurus/package-lock.json` to match.

Suggested commands:

```bash
npm --prefix docs/docusaurus pkg set devDependencies.eslint=9.39.4
npm --prefix docs/docusaurus install --package-lock-only
```

Commit and push to the same branch. Do not open a new PR.

## Do not change

- Any other dependency in `docs/docusaurus/package.json`. The PR's other updates must stay exactly as they are: `@docusaurus/*` 3.10.2, `react`/`react-dom` 19.2.8, `@testing-library/jest-dom` 7.0.0, `jest-axe` 11.0.0, `@playwright/test` 1.62.0, `@happy-dom/jest-environment` 20.11.1, `@typescript-eslint/parser` 8.65.0, `ts-jest` 29.4.12, `wait-on` 9.1.0.
- `eslint-plugin-jsx-a11y` — leave at `6.10.2`.
- Root `package.json` / `package-lock.json`.
- `evals/beval/**`.
- `.github/dependabot.yml`.
- `audit-ci.json`.
- The `.npmrc` files in `docs/docusaurus/` and `evals/beval/`.

## Acceptance criteria

- `docs/docusaurus/package.json` shows `"eslint": "9.39.4"`.
- `cd docs/docusaurus && npm ci` completes without `ERESOLVE`.
- `cd docs/docusaurus && npm test` passes.
- `npm run lint:public-dependency-feeds` passes from the repository root.
- In `docs/docusaurus/package-lock.json`, every `integrity` value starts with `sha512-` and every `resolved` URL points at `registry.npmjs.org`. No entry may reference `pkgs.visualstudio.com`, `packagefeedproxy.microsoft.io`, or any other non-public host.
- `git diff` touches only `docs/docusaurus/package.json` and `docs/docusaurus/package-lock.json`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.