chore(deps-dev): bump @metamask/eslint-config from 13.0.0 to 15.0.0 by dependabot[bot] · Pull Request #425 · MetaMask/accounts

dependabot · 2026-01-12T15:25:38Z

Bumps @metamask/eslint-config from 13.0.0 to 15.0.0.

Release notes

Sourced from @metamask/eslint-config's releases.

15.0.0

@metamask/eslint-config 15.0.0

Changed

BREAKING: Update jsdoc/require-jsdoc to require documentation for more things (#394)

New things that now require documentation are:

Arrow functions

Class declarations

TypeScript enum declarations

Function expressions

TypeScript interface declarations

Method definitions

TypeScript type alias declarations

TypeScript property signatures

BREAKING: Convert various rules from warn to error (#424)

The rules impacted are:

promise/no-callback-in-promise

promise/no-nesting

promise/no-promise-in-callback

promise/no-return-in-finally

promise/valid-params

@metamask/eslint-config-browser 15.0.0

Changed

BREAKING: Bump peer dependency on @metamask/eslint-config from ^14.0.0 to ^15.0.0 (#431)

@metamask/eslint-config-commonjs 15.0.0

Changed

BREAKING: Bump peer dependency on @metamask/eslint-config from ^14.0.0 to ^15.0.0 (#431)

@metamask/eslint-config-jest 15.0.0

Changed

BREAKING: Bump peer dependency on @metamask/eslint-config from ^14.0.0 to ^15.0.0 (#431)

BREAKING: Convert various rules from warn to error (#424)

The rules impacted are:

jest/expect-expect

jest/no-alias-methods

jest/no-commented-out-tests

jest/no-disabled-tests

Widen typescript peer dependency to allow all 5.x versions (#422)

@metamask/eslint-config-mocha 15.0.0

Changed

BREAKING: Bump peer dependency on @metamask/eslint-config from ^14.0.0 to ^15.0.0 (#431)

@metamask/eslint-config-nodejs 15.0.0

... (truncated)

Commits

0b8cf6d Release/15.0.0 (#431)
9568eb3 fix: Disable jsdoc/check-indentation to fix bullet list formatting (#430)
7837174 feat: Loosen @typescript-eslint/naming-convention for object literal proper...
cf93ef1 fix: Disable import-x/no-duplicates in TypeScript files (#427)
f3246f7 chore: Disable redudant lint rule (#425)
383fbec feat: Disable @typescript-eslint/no-unnecessary-type-arguments (#426)
a0e0bc8 feat: Convert all warnings to errors (#424)
b243e90 chore: Increase minimum typescript-eslint version (#423)
b116974 Allow remaining TypeScript 5.x versions (#422)
c70a3ff BREAKING: Update jsdoc/require-jsdoc to require documentation for more thin...
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Low Risk
Dev-only dependency bump that mainly affects linting behavior and CI; primary risk is new/stricter lint rules causing failures rather than runtime impact.

Overview
Bumps @metamask/eslint-config from ^13.0.0 to ^15.0.0 in package.json.

Updates yarn.lock to reflect the new eslint-config dependency graph, including pulling in newer @eslint/js and globals versions and shifting @metamask/eslint-config peer expectations toward ESLint 9 and newer prettier/eslint plugin versions.

^{Written by Cursor Bugbot for commit 92e2bde. This will update automatically on new commits. Configure here.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

socket-security · 2026-01-12T15:26:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@metamask/eslint-config@13.0.0 ⏵ 15.0.0	⁺²		⁺⁴	⁺¹

View full report

socket-security · 2026-01-12T15:26:11Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Network access: npm `globals` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: `?` → `npm/@metamask/eslint-config@15.0.0` → `npm/globals@15.15.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/globals@15.15.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cursor · 2026-01-12T15:28:19Z

package.json

    "@lavamoat/preinstall-always-fail": "^2.1.0",
    "@metamask/create-release-branch": "^3.1.0",
-    "@metamask/eslint-config": "^13.0.0",
+    "@metamask/eslint-config": "^15.0.0",


Unmet peer dependencies after eslint-config version bump

Medium Severity

The @metamask/eslint-config bump to v15.0.0 introduces multiple unmet peer dependencies. The new version requires eslint@^9.11.0, prettier@^3.3.3, eslint-plugin-import-x@^4.3.0, eslint-plugin-jsdoc@^50.2.4, eslint-plugin-prettier@^5.2.1, eslint-plugin-promise@^7.1.0, and eslint-config-prettier@^9.1.0, but the installed versions are all incompatible. Additionally, the sibling packages (eslint-config-jest, eslint-config-nodejs, eslint-config-typescript) at v13.0.0 require @metamask/eslint-config@^13.0.0 as a peer dependency. This incomplete upgrade will cause linting to fail or behave unexpectedly.

Additional Locations (1)

package.json#L47-L50

Bumps [@metamask/eslint-config](https://github.com/MetaMask/eslint-config) from 13.0.0 to 15.0.0. - [Release notes](https://github.com/MetaMask/eslint-config/releases) - [Commits](https://github.com/MetaMask/eslint-config/compare/@metamask/eslint-config@13.0.0...@metamask/eslint-config@15.0.0) --- updated-dependencies: - dependency-name: "@metamask/eslint-config" dependency-version: 15.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 12, 2026

dependabot bot requested a review from a team as a code owner January 12, 2026 15:25

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 12, 2026

cursor bot reviewed Jan 12, 2026

View reviewed changes

dependabot bot force-pushed the dependabot/npm_and_yarn/metamask/eslint-config-15.0.0 branch 2 times, most recently from ad9ece1 to 27d53ae Compare January 27, 2026 14:36

dependabot bot force-pushed the dependabot/npm_and_yarn/metamask/eslint-config-15.0.0 branch 4 times, most recently from 604396b to 4fbcd03 Compare February 4, 2026 12:24

dependabot bot force-pushed the dependabot/npm_and_yarn/metamask/eslint-config-15.0.0 branch 7 times, most recently from 6491d32 to 34e11db Compare February 6, 2026 11:55

dependabot bot force-pushed the dependabot/npm_and_yarn/metamask/eslint-config-15.0.0 branch from 34e11db to 92e2bde Compare February 9, 2026 11:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump @metamask/eslint-config from 13.0.0 to 15.0.0#425

chore(deps-dev): bump @metamask/eslint-config from 13.0.0 to 15.0.0#425
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/metamask/eslint-config-15.0.0

dependabot bot commented on behalf of github Jan 12, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Jan 12, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Jan 12, 2026 •

edited

Loading

Uh oh!

cursor bot Jan 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

15.0.0

@​metamask/eslint-config 15.0.0

Changed

@​metamask/eslint-config-browser 15.0.0

Changed

@​metamask/eslint-config-commonjs 15.0.0

Changed

@​metamask/eslint-config-jest 15.0.0

Changed

@​metamask/eslint-config-mocha 15.0.0

Changed

@​metamask/eslint-config-nodejs 15.0.0

Uh oh!

socket-security bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot Jan 12, 2026

Choose a reason for hiding this comment

Unmet peer dependencies after eslint-config version bump

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jan 12, 2026 •

edited

Loading

`@metamask/eslint-config` 15.0.0

`@metamask/eslint-config-browser` 15.0.0

`@metamask/eslint-config-commonjs` 15.0.0

`@metamask/eslint-config-jest` 15.0.0

`@metamask/eslint-config-mocha` 15.0.0

`@metamask/eslint-config-nodejs` 15.0.0

socket-security bot commented Jan 12, 2026 •

edited

Loading

socket-security bot commented Jan 12, 2026 •

edited

Loading