Update to ESLint 10, as ESLint 9 has been end of life since 6 August 2026

Problem/Motivation

Core lints its JavaScript with ESLint 9.39.5, which was the v9 final release. ESLint 9 reached end of life on 6 August 2026 and receives no further fixes, including security fixes.

ESLint 10.0.0 was released on 6 February 2026. The current release is 10.11.0.

#3621277: Update JavaScript dependencies for 12.0.0-beta1 tried the update to ESLint 10 but another core dependency (eslint-plugin-import 2.32.0, the current release from June 2025), declares support only up to ESLint 9. It already has ESLint 10 compatibility issues (#3227, #3265, #3267) closed and its last commit is from 1 August 2026, so compatibility exists on its main branch, but there is no release containing it and no announced date for one.

Unfortunately with ESLint 10 installed, yarn reports the peer dependency as unmet, although in practice yarn lint:core-js-passing passed with that combination on the #3621277: Update JavaScript dependencies for 12.0.0-beta1 branch.

Core uses the plugin for its recommended flat config and the import/no-mutable-exports rule. The JavaScript it applies to is almost entirely the 54 CKEditor 5 plugin source files, which are ES modules, plus two other module files.

Steps to reproduce

From @godotislate on #3621277: Update JavaScript dependencies for 12.0.0-beta1:

After the changes, though, one thing I'm noticing is this on yarn install:

➤ YN0000: · Yarn 4.18.0
➤ YN0000: ┌ Resolution step
➤ YN0000: └ Completed
➤ YN0000: ┌ Post-resolution validation
➤ YN0060: │ eslint is listed by your project with version 10.11.0 (p2d4e94), which doesn't satisfy what eslint-plugin-import and other dependencies request (but they have non-overlapping ranges!).
➤ YN0002: │ Drupal@workspace:. doesn't provide typescript (p00e1f1), requested by eslint-plugin-jsdoc.
➤ YN0086: │ Some peer dependencies are incorrectly met by your project; run yarn explain peer-requirements <hash> for details, where <hash> is the six-letter p-prefixed code.
➤ YN0000: └ Completed
➤ YN0000: ┌ Fetch step
➤ YN0013: │ 19 packages were added to the project (+ 14.19 MiB).
➤ YN0000: └ Completed in 0s 468ms
➤ YN0000: ┌ Link step
➤ YN0007: │ @nightwatch/nightwatch-inspector@npm:1.0.1 must be built because it never has been before or the last one failed
➤ YN0000: └ Completed in 2s 570ms
➤ YN0000: · Done with warnings in 3s 181ms

Proposed resolution

Decide how to handle eslint-plugin-import, then update. The options:

1. Update to ESLint 10 and keep eslint-plugin-import 2.32.0. Declare the wider peer range through packageExtensions in core/.yarnrc.yml so the install is warning-free. This is known to work today, but it is a combination the plugin does not claim to support, and a later ESLint 10 minor could break it with no fix available.
2. Switch to eslint-plugin-import-x. Version 4.17.1 from June 2026 supports ESLint 8.57, 9 and 10 and is actively maintained. It is a fork with the same rules under the import-x/ prefix, so eslint.config.mjs changes its import, its flat config reference, the one rule name and the one setting name. We don't know if this will keep being supported especially once eslint-plugin-import comes out with their v10 compatible release.
3. Wait for an eslint-plugin-import release with ESLint 10 support. No code changes, but no timeline either, and core stays on an unsupported linter until it happens.
4. Drop eslint-plugin-import. Removes the blocker entirely, but loses unresolved-import, duplicate-import and named-export checking on the CKEditor 5 plugin sources, which is where it is useful now.

Whichever option is chosen, the ESLint 10 update itself needs these changes, all worked out on the #3621277: Update JavaScript dependencies for 12.0.0-beta1 branch before the revert to ESLint 9:

• ESLint 10 no longer installs @eslint/js as a dependency of its own. eslint.config.mjs imports it, so it must be an explicit devDependency at the matching major. #3621277 already adds it at 9.39.5; this issue should bump it to 10.
• ESLint 10 adds no-useless-assignment and no-unassigned-vars to its recommended rule set. They flag nine existing lines in core/misc (dialog.js, displace.js, tabledrag.js, contextual.js, views-admin.js) and in Default Admin (tabledrag.js, tableselect.js). We should fix those lines with the ESLint update.

Remaining tasks

Discussion can happen already. Should land after #3621277: Update JavaScript dependencies for 12.0.0-beta1, which this builds on.

User interface changes

None.

API changes

None.

Data model changes

None.

Release notes snippet

None.

LLM disclosure

LLM was used to collect release information, dependency compatibility data and lint results summarized above, and to draft a version of the issue text that was then heavily hand edited.