[Snyk] Security upgrade eslint from 8.49.0 to 9.0.0

[wiatrM]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-JSYAML-13961110	631

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

---

Note

Upgrade eslint to 9.0.0 and update/pin related dependencies in package-lock.json, including @eslint/*, espree, eslint-scope, globals, file-entry-cache, flat-cache, js-yaml, and pin @types/node to 20.19.1.

• Dependencies:
  • Bump eslint from 8.49.0 to 9.0.0 in package.json.
  • Pin @types/node to 20.19.1.
• Lockfile updates:
  • Update linting stack: @eslint/eslintrc → 3.x, @eslint/js → 9.x, espree → 10.x, eslint-scope → 8.x, eslint-visitor-keys → 4.x, globals → 14.x.
  • Bump file-entry-cache → 8.x and flat-cache → 4.x.
  • Update js-yaml to 4.1.1.
  • Adjust placement of @typescript-eslint/parser under eslint-config-next tree.

^{Written by Cursor Bugbot for commit 1ddfef7. This will update automatically on new commits. Configure here.}

[Copilot]

Pull Request Overview

This PR attempts to upgrade ESLint from 8.49.0 to 9.0.0 to fix a prototype pollution vulnerability in the js-yaml dependency (SNYK-JS-JSYAML-13961110). However, this major version upgrade introduces breaking compatibility issues with the existing Next.js tooling configuration.

Key Changes:

• ESLint upgraded from 8.49.0 to 9.0.0 (major version with breaking changes)
• Related ESLint dependencies updated to versions compatible with ESLint 9.x
• js-yaml upgraded from 4.1.0 to 4.1.1 (security fix)

Critical Issue: The upgrade creates peer dependency conflicts - eslint-config-next@13.5.11 and its plugins (@typescript-eslint/parser, eslint-plugin-react, eslint-plugin-react-hooks) only support ESLint up to version 8.x, making this upgrade incompatible with the current Next.js setup.

Reviewed Changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Upgrades eslint from 8.49.0 to 9.0.0; removes caret from @types/node and eslint-config-next versions
package-lock.json	Updates eslint and its entire dependency tree; moves several plugins to nested node_modules due to peer dependency conflicts; upgrades js-yaml to fix security vulnerability

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The upgrade to ESLint 9.0.0 is incompatible with eslint-config-next@13.5.11 (line 76 in the diff). ESLint 9.x introduced breaking changes including a new flat config system, and eslint-config-next@13.5.11 was built for ESLint 8.x. You should upgrade eslint-config-next to a version that supports ESLint 9.x (version 14.x or later) or stay on ESLint 8.x to maintain compatibility with your current Next.js tooling.

Suggested change

	"eslint-config-next": "13.5.11",
	"eslint-config-next": "^14.0.0",

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: ESLint 9 Breaks Linting Ecosystem

Upgrading eslint to 9.0.0 creates a peer dependency conflict with eslint-config-next@13.5.11, which only supports eslint versions ^7.23.0 || ^8.0.0. The ESLint plugins used by eslint-config-next (including @typescript-eslint/parser and eslint-plugin-react-hooks) also don't support ESLint 9.x, which will cause the linting configuration to fail or behave unexpectedly.