chore(deps-dev): bump @metamask/eslint-config from 13.0.0 to 15.0.0 #425

dependabot · 2026-01-12T15:25:38Z

Bumps @metamask/eslint-config from 13.0.0 to 15.0.0.

Release notes

Sourced from @metamask/eslint-config's releases.

15.0.0

@metamask/eslint-config 15.0.0

Changed

BREAKING: Update jsdoc/require-jsdoc to require documentation for more things (#394)

New things that now require documentation are:

Arrow functions

Class declarations

TypeScript enum declarations

Function expressions

TypeScript interface declarations

Method definitions

TypeScript type alias declarations

TypeScript property signatures

BREAKING: Convert various rules from warn to error (#424)

The rules impacted are:

promise/no-callback-in-promise

promise/no-nesting

promise/no-promise-in-callback

promise/no-return-in-finally

promise/valid-params

@metamask/eslint-config-browser 15.0.0

Changed

BREAKING: Bump peer dependency on @metamask/eslint-config from ^14.0.0 to ^15.0.0 (#431)

@metamask/eslint-config-commonjs 15.0.0

Changed

BREAKING: Bump peer dependency on @metamask/eslint-config from ^14.0.0 to ^15.0.0 (#431)

@metamask/eslint-config-jest 15.0.0

Changed

BREAKING: Bump peer dependency on @metamask/eslint-config from ^14.0.0 to ^15.0.0 (#431)

BREAKING: Convert various rules from warn to error (#424)

The rules impacted are:

jest/expect-expect

jest/no-alias-methods

jest/no-commented-out-tests

jest/no-disabled-tests

Widen typescript peer dependency to allow all 5.x versions (#422)

@metamask/eslint-config-mocha 15.0.0

Changed

BREAKING: Bump peer dependency on @metamask/eslint-config from ^14.0.0 to ^15.0.0 (#431)

@metamask/eslint-config-nodejs 15.0.0

... (truncated)

Commits

0b8cf6d Release/15.0.0 (#431)
9568eb3 fix: Disable jsdoc/check-indentation to fix bullet list formatting (#430)
7837174 feat: Loosen @typescript-eslint/naming-convention for object literal proper...
cf93ef1 fix: Disable import-x/no-duplicates in TypeScript files (#427)
f3246f7 chore: Disable redudant lint rule (#425)
383fbec feat: Disable @typescript-eslint/no-unnecessary-type-arguments (#426)
a0e0bc8 feat: Convert all warnings to errors (#424)
b243e90 chore: Increase minimum typescript-eslint version (#423)
b116974 Allow remaining TypeScript 5.x versions (#422)
c70a3ff BREAKING: Update jsdoc/require-jsdoc to require documentation for more thin...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Updates linting setup to the latest MetaMask config.

Upgrade @metamask/eslint-config from ^13 to ^15 in package.json and workspace, with corresponding yarn.lock changes
Lockfile adds @eslint/js@^9 and globals@^15 and reflects new peer ranges (e.g., eslint@^9, prettier@^3, updated eslint plugins)
No source code changes; dependency and lockfile updates only

^{Written by Cursor Bugbot for commit e901a94. This will update automatically on new commits. Configure here.}

Bumps [@metamask/eslint-config](https://github.com/MetaMask/eslint-config) from 13.0.0 to 15.0.0. - [Release notes](https://github.com/MetaMask/eslint-config/releases) - [Commits](https://github.com/MetaMask/eslint-config/compare/@metamask/eslint-config@13.0.0...@metamask/eslint-config@15.0.0) --- updated-dependencies: - dependency-name: "@metamask/eslint-config" dependency-version: 15.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-01-12T15:26:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@metamask/eslint-config@13.0.0 ⏵ 15.0.0	⁺²		⁺⁴	⁺⁶

View full report

socket-security · 2026-01-12T15:26:11Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Network access: npm `globals` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: `?` → `npm/@metamask/eslint-config@15.0.0` → `npm/globals@15.15.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/globals@15.15.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cursor · 2026-01-12T15:28:19Z

package.json

    "@lavamoat/preinstall-always-fail": "^2.1.0",
    "@metamask/create-release-branch": "^3.1.0",
-    "@metamask/eslint-config": "^13.0.0",
+    "@metamask/eslint-config": "^15.0.0",


Unmet peer dependencies after eslint-config version bump

Medium Severity

The @metamask/eslint-config bump to v15.0.0 introduces multiple unmet peer dependencies. The new version requires eslint@^9.11.0, prettier@^3.3.3, eslint-plugin-import-x@^4.3.0, eslint-plugin-jsdoc@^50.2.4, eslint-plugin-prettier@^5.2.1, eslint-plugin-promise@^7.1.0, and eslint-config-prettier@^9.1.0, but the installed versions are all incompatible. Additionally, the sibling packages (eslint-config-jest, eslint-config-nodejs, eslint-config-typescript) at v13.0.0 require @metamask/eslint-config@^13.0.0 as a peer dependency. This incomplete upgrade will cause linting to fail or behave unexpectedly.

Additional Locations (1)

package.json#L47-L50

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 12, 2026

dependabot bot requested a review from a team as a code owner January 12, 2026 15:25

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 12, 2026

cursor bot reviewed Jan 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps-dev): bump @metamask/eslint-config from 13.0.0 to 15.0.0 #425

chore(deps-dev): bump @metamask/eslint-config from 13.0.0 to 15.0.0 #425

Uh oh!

dependabot bot commented on behalf of github Jan 12, 2026 •

edited by cursor bot

Loading

Uh oh!

socket-security bot commented Jan 12, 2026

Uh oh!

socket-security bot commented Jan 12, 2026

Uh oh!

cursor bot Jan 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

chore(deps-dev): bump @metamask/eslint-config from 13.0.0 to 15.0.0 #425

Are you sure you want to change the base?

chore(deps-dev): bump @metamask/eslint-config from 13.0.0 to 15.0.0 #425

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 12, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

15.0.0

@​metamask/eslint-config 15.0.0

Changed

@​metamask/eslint-config-browser 15.0.0

Changed

@​metamask/eslint-config-commonjs 15.0.0

Changed

@​metamask/eslint-config-jest 15.0.0

Changed

@​metamask/eslint-config-mocha 15.0.0

Changed

@​metamask/eslint-config-nodejs 15.0.0

Uh oh!

socket-security bot commented Jan 12, 2026

Uh oh!

socket-security bot commented Jan 12, 2026

Uh oh!

cursor bot Jan 12, 2026

Choose a reason for hiding this comment

Unmet peer dependencies after eslint-config version bump

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Jan 12, 2026 •

edited by cursor bot

Loading

`@metamask/eslint-config` 15.0.0

`@metamask/eslint-config-browser` 15.0.0

`@metamask/eslint-config-commonjs` 15.0.0

`@metamask/eslint-config-jest` 15.0.0

`@metamask/eslint-config-mocha` 15.0.0

`@metamask/eslint-config-nodejs` 15.0.0