microsoft / microsoft/hve-core
Pin eslint to 9.39.4 in docs/docusaurus and regenerate lockfile (PR #2519)
- Dominant language
- Python
- Stars
- 1.5k
- Forks
- 301
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 92
Description
## Task
Pin `eslint` back to `9.39.4` in `docs/docusaurus` and regenerate that project's lockfile.
## Why
PR #2519 bumps `eslint` to `10.8.0`, but `eslint-plugin-jsx-a11y@6.10.2` declares a peer range that stops at `^9`. This makes `npm ci` fail with `ERESOLVE` in the "Docusaurus Unit Tests" check, before any test runs. `6.10.2` is the latest published release of that plugin, so there is no compatible version to upgrade into. Upstream tracking: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/issues/1075
This change cannot be made locally because the contributor machine cannot reach `https://registry.npmjs.org/`, and the reachable internal mirror omits `dist.integrity`, which downgrades lockfile hashes to `sha1` and fails `npm run lint:public-dependency-feeds`.
## Scope
Branch: `dependabot/npm_and_yarn/npm-dependencies-c586aca45b`
Make exactly these changes:
1. In `docs/docusaurus/package.json`, set `devDependencies.eslint` to `9.39.4` (currently `10.8.0`).
2. Regenerate `docs/docusaurus/package-lock.json` to match.
Suggested commands:
```bash
npm --prefix docs/docusaurus pkg set devDependencies.eslint=9.39.4
npm --prefix docs/docusaurus install --package-lock-only
```
Commit and push to the same branch. Do not open a new PR.
## Do not change
- Any other dependency in `docs/docusaurus/package.json`. The PR's other updates must stay exactly as they are: `@docusaurus/*` 3.10.2, `react`/`react-dom` 19.2.8, `@testing-library/jest-dom` 7.0.0, `jest-axe` 11.0.0, `@playwright/test` 1.62.0, `@happy-dom/jest-environment` 20.11.1, `@typescript-eslint/parser` 8.65.0, `ts-jest` 29.4.12, `wait-on` 9.1.0.
- `eslint-plugin-jsx-a11y` — leave at `6.10.2`.
- Root `package.json` / `package-lock.json`.
- `evals/beval/**`.
- `.github/dependabot.yml`.
- `audit-ci.json`.
- The `.npmrc` files in `docs/docusaurus/` and `evals/beval/`.
## Acceptance criteria
- `docs/docusaurus/package.json` shows `"eslint": "9.39.4"`.
- `cd docs/docusaurus && npm ci` completes without `ERESOLVE`.
- `cd docs/docusaurus && npm test` passes.
- `npm run lint:public-dependency-feeds` passes from the repository root.
- In `docs/docusaurus/package-lock.json`, every `integrity` value starts with `sha512-` and every `resolved` URL points at `registry.npmjs.org`. No entry may reference `pkgs.visualstudio.com`, `packagefeedproxy.microsoft.io`, or any other non-public host.
- `git diff` touches only `docs/docusaurus/package.json` and `docs/docusaurus/package-lock.json`.
Contributor guide
Assessment
This issue has not been assessed yet.