npm / eslint
eslint
What changed in eslint 9 to 10, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
28 breaking3 security2 deprecations16 new APIs and options1 performance20 behavior and defaults4 tooling85 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initeslint 10139 changes
Breaking changes 28
Reports references inside immediately invoked function expressions.
Built-ins are exempted only when they reference the global.
The rule now reports unsafe labeled continue statements.
Reports max-nested-callbacks violations at the function head.
eslint-env comments are now reported as errors.
The rules included in eslint:recommended have been updated.
Legacy eslintrc configuration support has been removed.
The fake FlatESLint export has been removed.
The func-names rule schema has been tightened.
Versions of jiti older than 2.2.0 are no longer supported.
The fake LegacyESLint export has been removed.
The deprecated LintMessage#nodeType field has been removed.
The rule schema now requires unique items in its option array.
no-shadow-restricted-names reports globalThis by default.
Supported Node.js versions are now ^20.19.0, ^22.13.0, or >=24.
ParserOptions no longer includes ecmaVersion.
ParserOptions no longer includes sourceType.
Program ranges now span the entire source text.
ResultsMeta now includes a color property.
Deprecated rule context methods have been removed.
All RuleFixer methods now assert that text is a string.
Valid test cases now use stricter assertions.
Global variables are added through ScopeManager#addGlobals().
Deprecated SourceCode methods have been removed.
The TDZ scope type has been removed.
The deprecated TestCaseError#type field has been removed.
Inactive unstable_* flags have been removed.
The v10_* flags have been removed.
Security 1
The html formatter now escapes reserved characters in rule IDs, producing safer formatter output.
Deprecations 2
The always option of radix is deprecated.
The as-needed option of radix is deprecated.
New APIs and options 16
Accepts tokens and comments as inputs.
Adds d and v flags to no-unexpected-multiline.
Adds checkConditionalExpressions to inspect conditional expressions for unmodified loop conditions.
ConfigObject is now exported from eslint/config for use by developers consuming ESLint configuration APIs.
Added support for constructor callbacks in max-nested-callbacks.
Added the errorClassNames option to preserve-caught-error.
Adds checkRelationalComparisons to control checking of relational comparisons.
Adds includeIgnoreFile() to eslint/config for incorporating ignore files into configuration.
Rules can declare the languages they support through meta.languages.
Temporal is now included among the ES2026 globals.
API support for bulk suppressions was added.
Configuration objects can include a name.
max-params adds the countThis option.
no-implied-eval now supports self as an option.
RuleTester adds error assertion options.
RuleTester adds the requireData assertion option.
Performance 1
The rule no longer uses a quadratic-time regular expression, improving lint performance.
Behavior and default changes 17
Checks
globalThisfor invalid object calls.Checks
yield*expressions for unsafe optional chaining.The ignoreConstructors option now handles quoted properties.
Checks Object.prototype property names.
The radix rule now supports computed Number.parseInt member access.
The radix rule now reports invalid signed numeric radix values.
The rule now detects constant binary expressions involving Symbol() and BigInt().
Reports max-depth violations on keywords.
Reports max-lines-per-function violations at the function head.
Updates max-statements error locations to the function header.
The rule now checks sequence expressions in for-loop conditions.
The rule now provides suggestions for unused private class members.
The rule now recognizes Temporal objects when checking for disallowed object calls.
The no-var rule now applies fixes within TSModuleBlock nodes.
array-callback-return now handles Array.fromAsync callbacks.
JSX references are tracked during linting.
RuleTester outputs the failing test case index.
Tooling 4
Added suggestions to no-compare-neg-zero.
Reports no-with violations at the with keyword.
Failure locations are estimated for RuleTester assertions.
ESLint replaces chalk with styleText for terminal styling.
Fixes and other changes 70
Prevents combined fixes from creating a redeclared
let.Fixes handling of astral letters.
Adds the missing space after else in autofixes.
Supports TSFunctionType nodes.
Corrects messages for long private names.
Skips lines containing multiple comments.
Handles astral letters when enforcing capitalization conventions.
Fixes handling of astral letters.
Fixes handling of astral letters.
Avoids a false positive for 0.e5.
Avoids a false positive in conditional tests.
Corrects autofixing for async function bases.
The rule no longer reports __proto__ properties.
The rule now ignores __proto__ properties.
TimePass.parse is now optional in the types.
Adds support for __proto__ in exported comments.
Fixes a false positive for UTC calls when properties is false.
Fixes false negatives involving class fields and static blocks.
Ignores static imports when reporting unreachable code.
Prevents the autofix from breaking when Object is shadowed.
Fixes a false positive for numeric literals with a trailing decimal point.
The rule now handles numeric underflow cases.
Prevents unsafe autofixes when functions are hoisted.
Prevents autofixes when a var is shadowed by a catch parameter.
Prevents invalid autofixes that create a tagged template call.
False positives are corrected for the accessor-pairs rule.
False positives are corrected for the getter-return rule.
Meta-property names are now ignored when checking identifiers against the denylist.
Meta-property names are now ignored when checking identifiers against the configured pattern.
The autofix now prevents an ASI hazard when removing unused labels.
The removeVar suggestion now handles ASI hazards safely.
Ignore configurations are now applied to computed methods.
The rule no longer crashes when all loop types are ignored.
The rule now adds a semicolon when inserting parentheses.
The rule now handles NewExpression nodes with a parenthesized callee.
Fixed handling of static template literals.
The null option no longer reports non-equality operators.
ignoreClassesWithImplements now applies to class expressions.
Avoided false positives for shadowed RegExp.
Sequence expression operands are now parenthesized correctly.
Avoided false positives for shadowed RegExp.
Avoided false positives for shadowed globals.
Cause insertion now occurs outside wrapping parentheses.
Avoided false positives for spread arguments.
Avoided false positives on shadowed NaN and Number.
Restores the rule's report range for files containing too many classes.
Fixes callback detection for IIFEs and avoids reporting inner non-callbacks.
The rule now correctly accounts for a shadowed Boolean identifier.
Suppresses an invalid class suggestion produced by the rule.
The rule no longer reports shadowed undefined identifiers.
Fixes an invalid autofix when the rule reports an expression at the start of a statement.
The rule no longer reports shadowed undefined identifiers or shadowed Promise references.
The rule no longer reports shadowed undefined identifiers.
Corrects max-depth handling for else-if chains.
Corrected stack tracking for max-nested-callbacks violations.
Adds missing CodePath and CodePathSegment types for consumers of ESLint's type definitions.
Failures from delegated commands are now propagated so command-line failures are reported correctly.
Corrects an invalid autofix when a newline appears after async.
Prevents a false positive for a reference in a finally block.
Deprecated rule replacements that are not arrays are now handled correctly.
ESLint now handles an unavailable require cache, preventing failures when the cache cannot be accessed.
Rule suggestions no longer cause unintended continuation in a class body.
Generator yield resumption paths are modeled correctly in code path analysis.
Language and processor validation errors are clarified, helping diagnose invalid configuration.
The rule no longer reports false positives when Promise is shadowed.
The no-var rule no longer autofixes when a variable is used before its declaration.
Messages now include the variable name, making reported useless assignments easier to identify.
The error message for unused suppressions was updated.
no-restricted-import messages have been corrected.
verifyAndFix now receives filename as its third argument.
eslint 920 changes
Security 2
ajv was updated to address security vulnerabilities.
A security vulnerability patch was applied for ESLint 9.x.
Behavior and default changes 3
The rule highlights only the static block header.
Error locations now point to the duplicate key.
The rule now highlights only the function header, changing where complexity warnings appear.
Fixes and other changes 15
Restored TypeScript 4.0 compatibility in ESLint types.
ESLint now warns when eslint-env configuration comments are found.
Only the node is passed to JS language visitor methods, correcting the visitor method arguments.
Error locations are updated.
Error locations are updated.
The rule now allows JSDoc comments.
Program nodes now use the AST.Program type.
Rule typings are corrected for more accurate TypeScript usage.
Scope typings are corrected for more accurate TypeScript usage.
Forward traversal now passes step arguments to visitors.
The error message is improved when a suggestion lacks a fix function.
Timing reporting is unified for concurrent linting.
The rule no longer incorrectly reports some numeric literals written with e notation.
Type support for isolated dependencies in pnpm was improved.
The SourceCode type definitions were corrected for developers using the API.