Update JavaScript dependencies for 12.0.0-beta1

Updating most things here except the ones mentioned in the IS plus cspell, eslint, postcss and stylelint as those tend to require more changes.

Steps to reproduce:

$ yarn upgrade-interactive
$ yarn vendor-update
$ yarn build:ckeditor5
$ yarn build:ckeditor5-types

transliterate appears to have a breaking change, so I downgraded it back to the original version for now.

I tried to regenerate the performance statistics but only succeeded in crashing my laptop, will try again later.

We should probably postpone this on all the other updates (specifically Node 24 followed by CSpell, but also Prettier and Nightwatch) since the update gets smaller after those and will conflict with them.

Reasons for changes in the commit above to the full JS dependency update, reformulated based on reasons figured out by my LLM. Decisions explained are by me, but some we may want to go a different way. See the eslint 10, eslint-plugin-yml and stylelint-config-standard items specifically.

• transliteration was updated from 2.3.5 to 2.6.1. Its browser bundle defines a transliteration object instead of a transliterate global, so core/misc/machine-name.js now uses transliteration.transliterate, and the eslint globals list now declares transliteration instead of transliterate. The MR had this bundle without the code change, which caused the JavaScript errors causing the Functional JavaScript and Nightwatch failures.
• eslint was updated from 9.39.4 to 10.11.0, which no longer installs @eslint/js as a dependency of its own, so @eslint/js was added as an explicit dev dependency because eslint.config.mjs imports it.
• eslint 10 also adds no-useless-assignment and no-unassigned-vars to the recommended rule set, which would finds issues on eleven existing lines in core, Claro and Default Admin. Instead of fixing those lines, both rules are set to off in eslint.config.mjs. We can decide to do the fixes instead and make core cleaner, it is only 11 lines, but did not want to make the decision myself :)
• eslint-plugin-no-jquery was updated from 5.0.0 to 6.0.0, which supports flat config directly and fails under the fixupPluginRules wrapper, so the wrapper was removed from eslint.config.mjs. That left @eslint/compat unused, so it was removed from package.json. We need to decide if we still want to include @eslint/compat for other reasons.
• eslint-plugin-yml was updated from 1.19.1 to 3.8.1, whose distributed file uses syntax newer than the ES2020 setting core lints with, which made the import/default rule fail when parsing it, so the import rules now ignore everything under node_modules. I don't think we should lint node_modules, so I think this is fine.
• stylelint-config-standard was updated from 38.0.0 to 40.0.0, which enables property-no-deprecated, which finds 74 existing uses of the deprecated page-break-*, word-wrap and clip in the themes. Instead of fixing those directly here that rule is set to null in .stylelintrc.json until the CSS is fixed separetely I would say.
• postcss-preset-env was updated from 10.4.0 to 11.5.3 and postcss-import from 16.1.1 to 17.0.0, which keep blank lines between rules in their output. This just needs to be done. So 121 compiled CSS files were regenerated with only whitespace differences. The build check requires the committed files to match the build output.
• webpack was updated from 5.102.1 to 5.111.1 and terser from 5.44.1 to 5.51.2, which produce slightly different minified output, so the five CKEditor 5 plugin builds were regenerated.
• @floating-ui/dom (1.7.4 to 1.8.0), sortablejs (1.15.6 to 1.15.7), tabbable (6.3.0 to 6.5.0) and tua-body-scroll-lock (1.6.0 to 1.6.3) were updated, so their copies under core/assets/vendor and their version entries in core.libraries.yml were regenerated with yarn vendor-update.
• caniuse-lite was updated from 1.0.30001753 to 1.0.30001810 and browserslist from 4.24.5 to 4.29.0 in yarn.lock with yarn up -R caniuse-lite browserslist. Neither is a direct dependency: browserslist resolves the "last 2 versions" targets in package.json from the caniuse-lite data, and postcss-preset-env and autoprefixer use that result to decide which fallbacks and prefixes to emit. The old data was what produced the two warnings quoted in comment #12 on every CSS build. The refresh also removed the duplicate browserslist 4.27.0 and baseline-browser-mapping 2.8.23 entries from the lockfile.
• The remaining packages (chokidar 4.0.3 to 5.0.0, dotenv 17.2.3 to 18.0.1, glob 11.1.0 to 13.0.6, globals 16.5.0 to 17.12.0, jsdom 27.1.0 to 30.1.0, webpack-cli 6.0.1 to 7.2.3, postcss 8.5.6 to 8.5.28, postcss-url 10.1.3 to 10.1.4, stylelint 16.25.0 to 17.15.0, stylelint-order 7.0.0 to 8.1.1, cspell 10.3.2 to 10.3.3, prettier 3.9.7 to 3.9.8) were updated to their latest releases with no further code changes needed.

Cleaned up IS, made the more limited MR hidden.

Nice work, @gábor hojtsy!

I have a couple comments on the MR.
Related to a couple MR comments:

which finds 74 existing uses of the deprecated page-break-*, word-wrap and clip in the themes. Instead of fixing those directly here that rule is set to null in .stylelintrc.json until the CSS is fixed separetely I would say.

Let's create that follow up.

eslint 10 also adds no-useless-assignment and no-unassigned-vars to the recommended rule set, which would finds issues on eleven existing lines in core, Claro and Default Admin. Instead of fixing those lines, both rules are set to off in eslint.config.mjs

And this follow up too.

transliteration was updated from 2.3.5 to 2.6.1. Its browser bundle defines a transliteration object instead of a transliterate global, so core/misc/machine-name.js now uses transliteration.transliterate, and the eslint globals list now declares transliteration instead of transliterate

Do we need a CR for this? It looks like the repo address changed, and there are no git tags for versions before v2.4.0, nor any indications in the changelog so it's non-obvious (at least to me) how to make this change.

Also, I repeated the upgrade steps locally and got nearly the same changes as the MR, aside from some new patch versions. After the changes, though, pne thing I'm noticing is this on yarn install:

➤ YN0000: · Yarn 4.18.0
➤ YN0000: ┌ Resolution step
➤ YN0000: └ Completed
➤ YN0000: ┌ Post-resolution validation
➤ YN0060: │ eslint is listed by your project with version 10.11.0 (p2d4e94), which doesn't satisfy what eslint-plugin-import and other dependencies request (but they have non-overlapping ranges!).
➤ YN0002: │ Drupal@workspace:. doesn't provide typescript (p00e1f1), requested by eslint-plugin-jsdoc.
➤ YN0086: │ Some peer dependencies are incorrectly met by your project; run yarn explain peer-requirements <hash> for details, where <hash> is the six-letter p-prefixed code.
➤ YN0000: └ Completed
➤ YN0000: ┌ Fetch step
➤ YN0013: │ 19 packages were added to the project (+ 14.19 MiB).
➤ YN0000: └ Completed in 0s 468ms
➤ YN0000: ┌ Link step
➤ YN0007: │ @nightwatch/nightwatch-inspector@npm:1.0.1 must be built because it never has been before or the last one failed
➤ YN0000: └ Completed in 2s 570ms
➤ YN0000: · Done with warnings in 3s 181ms

eslint-plugin-import is eslint 10 compatible on HEAD, but they have yet to put out a compatible release, with no timeline.

There is a fork project eslint-plugin-import-x that might be more actively maintained, but maybe eslint 10 should be done in a follow up?

Re transliteration, https://github.com/dzcpy/transliteration which we have in main does indeed redirect to https://github.com/yf-hk/transliteration which has the new API. As for a change record for this specifically, I added a draft at https://www.drupal.org/node/3625169 now

Re eslint-plugin-import I moved back to eslint 9 for now in the MR but that is already EOL as of a month ago: https://eslint.org/version-support/, so I don't think Drupal 12 would want to relase on it?

Re the property-no-deprecated rule, I wanted to fold that in but it does look like lots of changes, even though the same pattern repeated over and over. Also there are CSS build concerns that turned out :/ Opened #3625187: Replace deprecated CSS properties flagged by stylelint's property-no-deprecated rule as followup for that and added a patch file for now since it needs this MR first.

Re eslint update, I opened #3625189: Update to ESLint 10, as ESLint 9 has been end of life since 6 August 2026 as a followup. Need to discuss if releasing the beta on an EOL ESLint is a good idea or should also make that a beta blocker.

I think this covers all concerns?

Added some more questions for parts I don't understand. I was hoping to only land the trivial changes here that don't have side effects, and do the others in followups, as it's hard to read the diff with all the CSS whitespace changes mixed in.

@longwave: re the whitespace changes: main uses postcss 8.5.3; the MR uses postcss 8.5.28. Since postcss 8.5.19 whitespace handling changed with this changelog entry: "Fixed cleaning before for new nodes inserted to Root". Now when nested rules are flattened, each becomes a new node inserted into the root; older postcss discarded the blank line but 8.5.19 onwards keeps it. That is why every file with nesting got blank lines between its flattened rules, and files without nesting did not change.

I can back out the whitespace changes but that also means not updating postcss 8.5.6, postcss-preset-env 10.4.0, postcss-import 16.1.1 and postcss-url 10.1.3 in this MR. Should that too move to its own issue? Does this make it easier to proceed? :)

I responded to the other two MR comments, pushed one fix and explained the other.

@Gabor did you read the docs for each of the major version upgrades to see what the breaking changes were? Just because the LLM has made it work doesn't mean we are necessarily doing the right thing going forwards. For example see my comment about eslint-plugin-yml where the default config reference has apparently changed. As I mentioned there I think it's better to handle breaking changes in separate issues, that also helps us decide whether to backport them to 11.x or not.

I don't think it makes a difference if I don't read all the dependency major version upgrade docs after running yarn upgrade manually or using an LLM :) I don't have a recollection of prior package pain for example, its great to have humans that have that background to provide reviews.

I moved the postcss and postcss-import changes as you pointed out it was a entirely autogenerated LOT of whitespace changes indeed as a result of running those tools' updated versions. They should be done together due to reasons I researched and explained in #3625308: Update postcss, and postcss-import for Drupal 12. While postcss-import is a major version update for example, I did the evaluation there explicitly. This should make it easier to piece this further apart.

This is more manageable to review now and I think all these bumps are okay here - but there's a merge conflict.

Thanks for the review again @longwave. I think your MR comments on the eslint-plugin-yml are contradicting your latest note on all bumps are okay, so we should decide one way and I can either open the separate issue for that one or keep it here and update the doc comment to be cleaner :) I don't personally know the impact of not running the import/default rule in linting is, ie that does skipping that loose us.

OK let's revert eslint-plugin-yml here and do that either separately or if/when we update to ESLint 10.

The changes for stylelint, transliteration and eslint-plugin-jquery are contained to one line each and make sense to me.

Let's do it.

Opened #3625576: Update eslint-plugin-yml to 3.x with plenty options listed for the yaml plugin :) Updated issue summary with issues deferred and added the postcss one as done earlier. Do we need a release note snippet with ALL the updated major version packages at least?

No for the release note we usually just have a standard phrase about JavaScript dependencies being updated to their latest versions, as it doesn't really affect site owners directly (and a lot of them only affect core developers).

This looks straightforward enough now.

Committed/pushed to main, thanks!

I think we could backport some/all of these updates to 11.5 so moving there for backport. If a new issue is preferred that's fine too.

I'm going to open a new issue for 11.5 because there are some differences (we are still on ESLint 8 there for example), and complications with the CKEditor build.