Bump @eslint-react/eslint-plugin from 5.9.2 to 5.10.0 in /client

[dependabot]

Bumps @eslint-react/eslint-plugin from 5.9.2 to 5.10.0.

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.10.0 (2026-06-28)

What's Changed

📝 Documentation

• Added status emoji markers to recipe and rule documentation code examples (#1882).
• Fixed the v5.7.2 changelog entry for react-x/no-unused-state.
• Updated the community projects list.

🏗️ Internal

• Bumped eslint to ^10.6.0.
• Bumped js-yaml workspace override to ^4.3.0.

Full Changelog: Rel1cx/eslint-react@v5.9.5...v5.10.0

Attestation

https://github.com/Rel1cx/eslint-react/attestations/32986681

v5.9.5 (2026-06-27)

What's Changed

🐞 Fixes

• Compare.isEqual now recognizes structurally identical CallExpression nodes. This fixes false positives in the following rules when the compared target (event target, controller, or observed element) is derived from a function call such as window.matchMedia('…') or getEl():
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-fetch
  • react-web-api/no-leaked-resize-observer
  • react-web-api/no-leaked-intersection-observer

Full Changelog: Rel1cx/eslint-react@v5.9.4...v5.9.5

Attestation

https://github.com/Rel1cx/eslint-react/attestations/32856673

v5.9.4 (2026-06-26)

What's Changed

🐞 Fixes

• The following rules now detect member expression calls made with computed string property access (e.g. obj["foo"]()):
  • react-x/no-array-index-key
  • react-x/no-duplicate-key

... (truncated)

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.10.0 (2026-06-28)

📝 Documentation

• Added status emoji markers to recipe and rule documentation code examples (#1882).
• Fixed the v5.7.2 changelog entry for react-x/no-unused-state.
• Updated the community projects list.

🏗️ Internal

• Bumped eslint to ^10.6.0.
• Bumped js-yaml workspace override to ^4.3.0.

Full Changelog: Rel1cx/eslint-react@v5.9.5...v5.10.0

v5.9.5 (2026-06-27)

🐞 Fixes

• Compare.isEqual now recognizes structurally identical CallExpression nodes. This fixes false positives in the following rules when the compared target (event target, controller, or observed element) is derived from a function call such as window.matchMedia('…') or getEl():
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-fetch
  • react-web-api/no-leaked-resize-observer
  • react-web-api/no-leaked-intersection-observer

Full Changelog: Rel1cx/eslint-react@v5.9.4...v5.9.5

v5.9.4 (2026-06-26)

🐞 Fixes

• The following rules now detect member expression calls made with computed string property access (e.g. obj["foo"]()):
  • react-x/no-array-index-key
  • react-x/no-duplicate-key
  • react-x/no-unnecessary-use-prefix
  • react-x/set-state-in-effect
  • react-x/set-state-in-render
  • react-dom/no-find-dom-node
  • react-dom/no-flush-sync
  • react-dom/no-hydrate
  • react-dom/no-render
  • react-dom/no-render-return-value
  • react-dom/no-use-form-state
  • react-web-api/no-leaked-fetch

📝 Documentation

• Updated the community page and project list.

🏗️ Internal

... (truncated)

Commits

• 3a5e3af release: 5.10.0
• 62e9345 release: 5.9.5
• 0f9f809 refactor: unify member expression property name checks with Extract.getProper...
• f46334e release: 5.9.3
• cc8a72b chore: restructure test directory and add integration tests (#1880)
• f2f19bf chore: replace pnpm run with node --run (#1879)
• d1244b8 chore: refactor shared plugin domain constants (#1878)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Claudia-Anthropica]

@dependabot The bump itself is straightforward, but the PR currently fails every client install because the new @eslint-react 5.10.0 packages are still inside the 24-hour minimumReleaseAge window. Please refresh/re-run this update once the packages have aged past the cutoff so CI can validate the lockfile.

[Claudia-Anthropica]

@dependabot [medium] CI is rejecting this bump because the 5.10.0 @eslint-react packages were published inside the repo's 24-hour minimumReleaseAge window. Please rerun or rebase this dependency update after that window has elapsed so the lockfile can pass the supply-chain policy; do not relax the policy for this.

🤖 Prompt for AI agents

In client/package.json, @eslint-react/eslint-plugin is bumped to 5.10.0 while CI rejects the corresponding @eslint-react 5.10.0 packages under the repository minimumReleaseAge policy. Fix this by rerunning or rebasing the dependency update after the 24-hour window has elapsed and keep the lockfile generated under the existing policy; do not modify CI or relax security policy.