@next/codemod upgrade pins ESLint to 10 unprompted, failing install for projects using eslint-plugin-import

Link to the code that reproduces this issue

https://github.com/Jean-Marc18/next-codemod-eslint10-repro

To Reproduce

git clone https://github.com/Jean-Marc18/next-codemod-eslint10-repro
cd next-codemod-eslint10-repro
npm install
npx @next/codemod@canary upgrade latest

The repo is a stock create-next-app@15.5.0 project (TypeScript, ESLint, App Router) with one extra dev dependency: eslint-plugin-import@2.32.0.

Current vs. Expected behavior

Current. The codemod does not only upgrade next. It also rewrites eslint from the range the project had to an exact latest major:

- "eslint": "^9",
+ "eslint": "10.10.0",

npm install then fails, and the codemod stops before applying any transformation:

While resolving: n001@0.1.0
Found: eslint@10.10.0
node_modules/eslint
  dev eslint@"10.10.0" from the root project

Could not resolve dependency:
peer eslint@"^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9" from eslint-plugin-import@2.32.0
node_modules/eslint-plugin-import
  dev eslint-plugin-import@"^2.32.0" from the root project

Error: Failed to install dependencies
    at runInstallation (.../@next/codemod/lib/handle-package.js:173:15)
    at runUpgrade (.../@next/codemod/bin/upgrade.js:358:42)

The Next upgrade itself never happens.

Expected. Upgrade what the Next upgrade entails, and leave the rest of the ecosystem where it is.

The ESLint bump is not required by the target release:

$ npm view eslint-config-next@16.3.4 peerDependencies
{ eslint: '>=9.0.0', typescript: '>=3.3.1' }

And no released version of eslint-plugin-import supports ESLint 10:

$ npm view eslint-plugin-import@2.32.0 peerDependencies
{ eslint: '^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9' }

So the codemod upgrades a dependency the target release does not need, to a major that a widely used plugin cannot support yet. Replacing a caret range with a pinned exact version makes it harder to recover from, too.

If the bump is intentional, a message separating the two failures would already help a lot: "Next upgrade succeeded, ESLint alignment failed because ..." rather than a generic Failed to install dependencies, which reads as if upgrading Next were impossible.

Provide environment information

Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Pro
  Available memory (MB): 16239
  Available CPU cores: 8
Binaries:
  Node: 25.9.0
  npm: 11.12.1
  pnpm: 10.33.0
Relevant Packages:
  next: 15.5.0 (before the codemod)
  react: 19.1.0
  react-dom: 19.1.0
  typescript: 5.x

Which area(s) are affected? (Select all that apply)

Upgrade CLI (@next/codemod upgrade)

Which stage(s) are affected? (Select all that apply)

Other (Deployed, etc.)

Additional context

Found while upgrading a real project from 15.5.x to 16.3.4. Workaround was to upgrade by hand with npm install next@16.3.4; the four codemods published after 15.5.25 had no transformation to apply on that codebase, so nothing was lost by skipping the tool.

eslint-plugin-import is a common dependency of shared ESLint configs, so any project using one is likely to hit this.

Start by reproducing the issue with the linked repository and the documented npm install and npx @next/codemod@canary upgrade latest commands. Read @next/codemod/lib/handle-package.js around runInstallation and @next/codemod/bin/upgrade.js around runUpgrade. Done means the Next upgrade does not unnecessarily pin ESLint to 10, the dependency installation succeeds with eslint-plugin-import, or any separate ESLint failure is reported distinctly.