fix(deps): update eslint-tooling

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
eslint (source)	^10.4.1 → ^10.7.0
eslint-plugin-import-x	^4.16.2 → ^4.17.1
eslint-plugin-perfectionist (source)	^5.9.0 → ^5.10.0
typescript-eslint (source)	^8.60.0 → ^8.63.0

---

Release Notes

eslint/eslint (eslint)

v10.7.0

Compare Source

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#​21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#​21063) (fnx)
• 557fde8 feat: support computed Number.parseInt member access in radix rule (#​21041) (Pixel)
• 0b4a73b feat: add suggestions to no-compare-neg-zero (#​21034) (den$)
• 96cdd42 feat: report invalid signed numeric radix values in radix rule (#​21030) (Pixel)

Bug Fixes

• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#​21069) (Pixel)
• 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#​21062) (Mahin Anowar)
• 75ec753 fix: handle static template literals in eqeqeq rule (#​21058) (Pixel)
• b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#​21057) (Pixel)
• e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#​21051) (Pixel)
• a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#​21050) (Pixel)
• d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#​21045) (spokodev)
• 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#​21047) (한국)
• a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#​20958) (sethamus)
• 8a240a7 fix: avoid false positives in radix rule for spread arguments (#​21044) (Pixel)

Documentation

• c30d808 docs: Update README (GitHub Actions Bot)
• 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#​20980) (Alex Bit)
• 04174cb docs: Update README (GitHub Actions Bot)
• 026e130 docs: update semver policy for bug fixes (#​21048) (Milos Djermanovic)
• 9d42fef docs: Update README (GitHub Actions Bot)
• b230159 docs: Update README (GitHub Actions Bot)
• 0129972 docs: correct **/.js glob to **/*.js in config files guide (#​21036) (EduardF1)

Chores

• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#​21076) (renovate[bot])
• 81a4774 chore: updates for v9.39.5 release (Jenkins)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#​21071) (Francesco Trotta)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#​21067) (lumir)
• 833ec10 chore: update dependency prettier to v3.9.4 (#​21061) (renovate[bot])
• 7ea106d chore: update ecosystem plugins (#​21059) (ESLint Bot)
• 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#​21056) (lumir)
• e4e1166 chore: update dependency prettier to v3.9.1 (#​21055) (renovate[bot])
• 0493f53 chore: update prettier to v3.9.0 (#​21054) (Pixel)
• 1056a99 chore: update dependency prettier to v3.8.5 (#​21049) (renovate[bot])
• 4d4155d ci: run ecosystem tests on pull requests (#​21027) (sethamus)
• 993539f chore: update dependency @​eslint/json to ^2.0.1 (#​21042) (renovate[bot])
• 53f8b69 test: add error locations to no-constant-binary-expression (#​21039) (lumir)
• 5ab71d5 refactor: clean up radix rule internals (#​21015) (Pixel)
• a80a9a4 chore: update ecosystem plugins (#​21035) (ESLint Bot)
• 7c9a029 ci: add Node.js 26 to CI (#​20847) (lumir)

v10.6.0

Compare Source

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#​20981) (Taejin Kim)
• f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#​20948) (sethamus)

Bug Fixes

• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#​20997) (Milos Djermanovic)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#​21013) (den$)
• 8fd8741 fix: don't report shadowed undefined in radix rule (#​21011) (Pixel)
• 5784980 fix: don't report shadowed undefined in no-throw-literal (#​21010) (Pixel)
• 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#​21008) (Pixel)
• d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#​21006) (Pixel)
• 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#​21003) (den$)
• 63d52d2 fix: restore max-classes-per-file report range (#​21002) (Pixel)
• 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#​20979) (fnx)
• 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#​20995) (Milos Djermanovic)

Documentation

• a83683d docs: Update README (GitHub Actions Bot)
• f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#​20986) (playgirl)
• bea49f7 docs: Update README (GitHub Actions Bot)
• e5f70f9 docs: update code-path diagrams (#​20984) (Tanuj Kanti)
• 8890c2d docs: add TypeScript config guidance for MCP server (#​20796) (Pierluigi Lenoci)
• 3eb3d9b docs: Update README (GitHub Actions Bot)
• c5bb59c docs: Update README (GitHub Actions Bot)
• eb3c97c docs: fix grammar in prefer-const rule description (#​20983) (lumir)

Chores

• 6a42034 ci: run ecosystem tests on main branch (#​20891) (sethamus)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#​21014) (dependabot[bot])
• c3abfca chore: correct JSDoc param types in html formatter (#​21018) (Minseon Kim)
• a832320 ci: split ecosystem tests into separate jobs (#​21001) (xbinaryx)
• 27166e7 chore: update ecosystem plugins (#​21005) (ESLint Bot)
• 865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#​20989) (dependabot[bot])
• 27a88c9 chore: update dependency markdown-it to v14 in root (#​20994) (Milos Djermanovic)
• 970cea6 chore: update dependency markdown-it to v14 (#​20993) (Milos Djermanovic)
• b482120 chore: update dependency prettier to v3.8.4 (#​20990) (renovate[bot])
• 6993fb3 chore: update ecosystem plugins (#​20985) (ESLint Bot)

un-ts/eslint-plugin-import-x (eslint-plugin-import-x)

v4.17.1

Compare Source

Patch Changes

• #​498 cf25a01 Thanks @​marcalexiei! - fix(extensions): don't require an extension for package subpaths that resolve to a .d.ts (e.g. vitest/config)

v4.17.0

Compare Source

Minor Changes

• #​474 4b2c0c5 Thanks @​regseb! - Support RegExp in the import-x/ignore setting and the ignore option of the no-unresolved rule.

Patch Changes

• #​494 1c84235 Thanks @​morgan-coded! - Fixed no-unresolved crashing when case-sensitive path checks encounter EACCES or EPERM on an ancestor directory.

• #​481 3e13121 Thanks @​B4nan! - fix: memoize legacyNodeResolve resolver to avoid native memory leak

• #​484 9a07009 Thanks @​sairus2k! - Make the extensions rule check Node.js subpath imports (specifiers starting with #, e.g. #utils/helper). Previously parsePath treated a leading # as a URL hash fragment, so the rule skipped extension validation for these imports.

  Note: single-segment subpath imports without a slash (e.g. #dep) are still skipped by the existing external-root-module classification; fixing that is deferred to avoid expanding scope.

• #​468 240ed58 Thanks @​silverwind! - Make extensions handle .d.ts correctly

• #​479 e3cc7e4 Thanks @​mrginglymus! - fix: strip querystrings and hash fragments when checking for file existence

• #​476 fce29b1 Thanks @​nbouvrette! - fix(deps): replace @​package-json/types with an inline minimal type

azat-io/eslint-plugin-perfectionist (eslint-plugin-perfectionist)

v5.10.0

Compare Source

compare changes

🚀 Features

• sort-intersection-types: Add ignore callable types option
  (967da574)

🐞 Bug Fixes

• sort-modules: Allow sorting of decorated exported classes
  (05cc7218)
• sort-arrays: Require options to be provided
  (5417cb5a)
• Stop treating multiline trailing block comments as leading comments
  (5c66d19d)
• sort-switch-case: Skip condition-shaped switch statements
  (2bea3292)
• Detect dependencies in iifes, auto-accessors and computed enum access
  (119bafe6)

❤️ Contributors

• Azat S. (@​azat-io)
• Hugo (@​hugop95)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.63.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

Compare Source

🚀 Features

• remove redundant package.json "files" (#​12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 5am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

---

Note

Low Risk
Dependency-only lint tooling updates with no application or ESLint config source changes; main risk is new lint rule behavior or false positives after upgrades.

Overview
Bumps ESLint and related plugins used by @sanity/eslint-config-cli, with a patch changeset for that package.

In eslint-config-cli, eslint-plugin-import-x goes to ^4.17.1, eslint-plugin-perfectionist to ^5.10.0, and typescript-eslint to ^8.63.0. The workspace pnpm catalog raises shared eslint from ^10.4.1 to ^10.7.0, and pnpm-lock.yaml is refreshed so consumers resolve eslint 10.7.0 and the new plugin versions (the lockfile also reflects other transitive resolution shifts, e.g. fixture/workbench sanity pins).

^{Reviewed by Cursor Bugbot for commit ff3792c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Coverage Delta

No covered files changed in this PR.

Overall Coverage

Metric	Coverage
Statements	77.2% (±0%)
Branches	68.4% (±0%)
Functions	73.0% (+ 0.0%)
Lines	77.7% (±0%)

[github-actions]

📦 Bundle Stats — @sanity/cli

Compared against main (26a8bd9a)

@sanity/cli

Metric	Value	vs main (26a8bd9)
Internal (raw)	2.2 KB	-
Internal (gzip)	838 B	-
Bundled (raw)	11.16 MB	-
Bundled (gzip)	2.10 MB	-
Import time	854ms	+0ms, +0.0%

bin:sanity

Metric	Value	vs main (26a8bd9)
Internal (raw)	782 B	-
Internal (gzip)	423 B	-
Bundled (raw)	9.87 MB	-
Bundled (gzip)	1.78 MB	-
Import time	2.21s	+0ms, +0.0%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-core

Compared against main (26a8bd9a)

Metric	Value	vs main (26a8bd9)
Internal (raw)	108.1 KB	-
Internal (gzip)	27.0 KB	-
Bundled (raw)	21.72 MB	-
Bundled (gzip)	3.46 MB	-
Import time	760ms	-6ms, -0.8%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-build

Compared against main (26a8bd9a)

@sanity/cli-build/_internal/build

Metric	Value	vs main (26a8bd9)
Internal (raw)	113.0 KB	-
Internal (gzip)	28.4 KB	-
Bundled (raw)	17.94 MB	-
Bundled (gzip)	3.60 MB	-
Import time	1.31s	-4ms, -0.3%

@sanity/cli-build/_internal/env

Metric	Value	vs main (26a8bd9)
Internal (raw)	1.8 KB	-
Internal (gzip)	644 B	-
Bundled (raw)	1.31 MB	-
Bundled (gzip)	332.9 KB	-
Import time	121ms	-1ms, -0.9%

@sanity/cli-build/_internal/extract

Metric	Value	vs main (26a8bd9)
Internal (raw)	8.6 KB	-
Internal (gzip)	2.7 KB	-
Bundled (raw)	151.2 KB	-
Bundled (gzip)	38.3 KB	-
Import time	240ms	+1ms, +0.5%

🗺️ ./_internal/env · ./_internal/extract · @sanity/cli-build:./_internal/build treemap too large to embed · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — create-sanity

Compared against main (26a8bd9a)

Metric	Value	vs main (26a8bd9)
Internal (raw)	908 B	-
Internal (gzip)	483 B	-
Bundled (raw)	931 B	-
Bundled (gzip)	491 B	-
Import time	❌ ChildProcess denied: node	-

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​typescript-eslint@​8.63.0
	npm/​eslint-plugin-import-x@​4.17.1
	npm/​eslint-plugin-perfectionist@​5.10.0
	npm/​sanity@​6.5.0-workbench.20260714145319
	npm/​eslint@​10.7.0

View full report