Upgrade client ESLint to 10 once eslint-plugin-react supports it

[atomantic]

Problem

Dependabot's ESLint 10 bumps (#2879 eslint 9.39.4 → 10.7.0, #2875 @eslint/js
9.39.4 → 10.0.1 — both closed) fail at install, not at lint:

npm error code ERESOLVE
npm error While resolving: eslint-plugin-react@7.37.5

eslint-plugin-react@7.37.5 (latest as of 2026-07-22) declares:

peerDependencies.eslint = "^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7"

There is no ESLint 10 in that range, so the client dependency tree cannot resolve
with eslint 10 no matter which order the two PRs land in. This is an upstream
blocker, not something a lockfile regeneration or config change fixes.

Decision

Wait for eslint-plugin-react to ship ESLint 10 peer support, then take
eslint and @eslint/js together in a single PR. Do not work around it with
--legacy-peer-deps, an overrides entry, or by dropping
eslint-plugin-react — the plugin carries the React-specific rules the client
lint actually depends on, and forcing a peer mismatch would leave lint passing
against an unsupported combination.

Trigger to pick this up

npm view eslint-plugin-react peerDependencies.eslint includes a ^10 range.

Approach

1. Bump eslint, @eslint/js, and eslint-plugin-react in one commit in
   client/package.json (all three, or the resolution fails again).
2. Regenerate client/package-lock.json.
3. Run npm run lint --prefix client. ESLint 10 removes several long-deprecated
   context methods and changes some rule defaults, so expect eslint.config.js
   to need adjustment.
4. The client lint currently reports 0 errors / 4 warnings (unused
   eslint-disable directives). Keep it at 0 errors.

Acceptance criteria

• eslint, @eslint/js, eslint-plugin-react all on ESLint-10-compatible
  versions in client/package.json, lockfile regenerated.
• npm ci --prefix client resolves without ERESOLVE and without
  --legacy-peer-deps.
• npm run lint --prefix client reports 0 errors.
• No overrides entry added to force the peer range.

Affected files

• client/package.json / client/package-lock.json
• client/eslint.config.js

[atomantic]

Re-checked the trigger on 2026-07-24: still blocked. eslint-plugin-react@7.37.5 remains latest and still declares peerDependencies.eslint = "^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7" — no ^10 range, so the upstream blocker described above holds unchanged.

Adding a dimension this issue didn't originally have: this upgrade is now the only path that clears the client's remaining npm audit findings. All 8 high-severity findings in client/ route through the eslint 9 tree:

Package	Vulnerable range	Reaches the tree via
eslint	4.1.0 - 10.0.0-rc.2	direct devDependency (9.39.4)
@eslint/config-array	<=0.22.0	eslint 9
@eslint/eslintrc	>=0.1.1	eslint 9
minimatch	2.0.0 - 10.0.2	eslint 9
brace-expansion	<=5.0.7	minimatch 3 → brace-expansion 1.x
eslint-plugin-react	>=7.23.0	direct devDependency (7.37.5)

Notes for whoever picks this up:

• npm audit fix proposes downgrades here (eslint-plugin-react → 7.22.0, i.e. below the vulnerable floor). Don't take them; they trade a lint-tooling advisory for losing rules the client lint depends on.
• The brace-expansion entry is not fixable at the pin. The root/server/client overrides pin was bumped 5.0.7 → 5.0.8 in fix(deps): unpin postcss and brace-expansion overrides…, which cleared root and server, but the client's only installed copy is 1.1.16, forced by the nested "minimatch@3": { "brace-expansion": "1.1.16" } override. minimatch@3 requires brace-expansion@^1.1.7 and cannot accept the 5.x fix line, so that finding only disappears when eslint 10 drops minimatch 3 out of the tree.
• Scope is unchanged and remains dev-only: none of this ships to users, so the eslint cluster is correctly not urgent — it's just no longer purely hygiene, and closing it closes the client audit.

Dependabot alert #35 (react-router RSC CSRF) was dismissed separately as not-affected — unrelated to this cluster, and not something this upgrade touches.