[Snyk] Security upgrade eslint from 8.27.0 to 9.0.0

[revan-zhang]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json
• yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-FLATTED-15700433	740

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

---

---

Note

Medium Risk
Dependency-only change, but ESLint major version bump can break local linting/CI and may require config/plugin compatibility updates.

Overview
Upgrades eslint from v8 to v9 (Snyk-driven security fix) and refreshes yarn.lock to pull in the new ESLint dependency tree, including updates that address the reported flatted prototype pollution vulnerability.

No application/runtime code changes; impact is limited to development tooling and dependency resolution.

^{Written by Cursor Bugbot for commit 696b557. This will update automatically on new commits. Configure here.}

[revan-zhang]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint@​8.27.0 ⏵ 9.39.4			+1	+47

View full report

[devin-ai-integration]

Devin Review found 1 potential issue.

View 2 additional findings in Devin Review.

[devin-ai-integration]

🔴 ESLint 9 upgrade breaks linting: .eslintrc config and .eslintignore are ignored by default

ESLint 9 switched to the "flat config" system (eslint.config.js) by default. The project's .eslintrc configuration file and .eslintignore file will no longer be automatically loaded when running eslint . or eslint . --fix (see package.json:107-108). This means all custom rules, extends (wesbos/typescript), parser options, plugin settings, and ignore patterns defined in .eslintrc and .eslintignore will be silently dropped. ESLint will either error out (if it can't find a valid flat config) or lint with no project-specific rules applied.

Additionally, several eslint config/plugin dependencies are incompatible with ESLint 9:

• eslint-config-react-app@7.0.1
• eslint-config-wesbos@3.0.2
• eslint-config-airbnb@19.0.4
• eslint-config-airbnb-typescript@16.2.0
• eslint-plugin-react-hooks@4.6.0
• eslint-webpack-plugin@3.1.1

To fix this, either migrate to the flat config format and update all plugins, or stay on ESLint 8.

Suggested change

	"eslint": "^9.0.0",
	"eslint": "^8.23.1",

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

ESLint 9 upgrade breaks incompatible plugin ecosystem

High Severity

Upgrading eslint to ^9.0.0 (resolved to 9.39.4) without upgrading the companion ESLint ecosystem packages will break linting and builds. @typescript-eslint/eslint-plugin and @typescript-eslint/parser at ^5.38.0 require ESLint 8 (need v8+). eslint-webpack-plugin at ^3.1.1 doesn't support ESLint 9 (need v4.2.0+). eslint-config-react-app at ^7.0.1 doesn't support ESLint 9's flat config. The project's eslintConfig in package.json uses the legacy extends key, which is unsupported in ESLint 9's default flat config mode.

Additional Locations (2)

• package.json#L29-L31
• package.json#L59-L60