feat: adopt ESLint 10 by replacing eslint-plugin-react

[neolitec]

Closes #119.

ESLint 9 reached end of life on 2026-08-06, so holding at 9 now means running an unsupported linter. eslint-plugin-react still has no ESLint 10 release — last release was 7.37.5 in April 2025, and the compatibility PRs (#3979, #4022) have sat unreviewed for months. So we move instead of waiting.

The block was narrower than #119 recorded

Only one of the three plugins was actually broken:

Plugin	Reality	Action
eslint-plugin-react	genuinely broken — calls the removed context.getFilename() unguarded during React version detection, so every rule throws	→ @eslint-react/eslint-plugin
eslint-plugin-jsx-a11y	works fine; only its declared peer range lagged	→ eslint-plugin-jsx-a11y-x (e18e fork, declares ^9 || ^10)
eslint-plugin-import	never wired into eslint.config.js at all — only present as a peer of the equally unused eslint-import-resolver-typescript	both deleted

Two of the three "blockers" were doing nothing. That's the bulk of the lockfile shrink.

Behaviour changes

• react/no-unused-prop-types is dropped. ESLint React has no equivalent (it's a PropTypes-era rule). Costs nothing here — this package is TypeScript-only and ships no PropTypes.
• The jsx-runtime config is gone. ESLint 10 tracks JSX references natively.
• 15 new warnings from the stricter ruleset are disabled at config level, each with its reasoning inline. All were inapplicable or actively wrong for this package:
  • no-children-map / no-children-to-array / no-clone-element (9×) — this is the library's core mechanism: it reads <Tab> children's props and clones them with the wiring they need.
  • no-forward-ref — peerDependencies still declare react: ^17 \|\| ^18 \|\| ^19. Passing ref as a plain prop would break every consumer below 19. Revisit when the peer range drops <19.
  • naming-convention-ref-name (4×) — assumes useRef holds a DOM ref; ours hold a timer handle, a focus index and a node array. timeoutId and tabRefs are the accurate names.
  • use-state — false positive; useState is already destructured, the rule just doesn't recognise a destructuring pattern in the value position.

Also

• Removed the eslint / @eslint/js major holds from dependabot.yml (added in ci: hold back the ESLint and TypeScript majors that are blocked upstream #123) — there's nothing left to hold. The typescript hold stays; TS 7 is a separate block.
• CI lint job moves Node 20 → 22, the floor declared by @eslint-react/eslint-plugin. Verified it does run on Node 20 in practice, but matching the declared engine avoids surprises.

Verification

pnpm lint exits 0 with zero warnings, pnpm build exits 0, 68/68 tests pass across 5 files. New dependencies are MIT with SLSA provenance attestations.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint-plugin-jsx-a11y-x@​0.2.0
	@​eslint/​js@​10.0.1
	@​eslint-react/​eslint-plugin@​5.18.6
	eslint@​10.8.1

View full report