[dependabot]

Bumps eslint-plugin-react-hooks from 4.6.2 to 7.1.1.

Release notes

Sourced from eslint-plugin-react-hooks's releases.

eslint-plugin-react-hooks@7.1.1 (April 17, 2026)

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

• Add deprecated no-op component-hook-factories rule for backwards compatibility. (@​mofeiZ in #36307)

eslint-plugin-react-hooks@7.1.0 (April 16, 2026)

This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better set-state-in-effect detection, improved ref validation, and more helpful error reporting.

• Add ESLint v10 support. (@​azat-io in #35720)
• Skip compilation for non-React files to improve performance. (@​josephsavona in #35589)
• Fix exhaustive deps bug with Flow type casting. (@​jorge-cab in #35691)
• Fix useEffectEvent checks in component syntax. (@​jbrown215 in #35041)
• Improved set-state-in-effect validation with fewer false negatives. (@​jorge-cab in #35134, @​josephsavona in #35147, @​jackpope in #35214, @​chesnokov-tony in #35419, @​jsleitor in #36107)
• Improved ref validation for non-mutating functions and event handler props. (@​josephsavona in #35893, @​kolvian in #35062)
• Compiler now reports all errors instead of stopping at the first. (@​josephsavona in #35873–#35884)
• Improved source locations and error display in compiler diagnostics. (@​nathanmarks in #35348, @​josephsavona in #34963)

eslint-plugin-react-hooks@5.0.0 (Oct 11, 2024)

This release only contains eslint-plugin-react-hooks. Notably, new violations and support for ESLint v9 were added.

eslint-plugin-react-hooks

• New Violations: Component names now need to start with an uppercase letter instead of a non-lowercase letter. This means _Button or _component are no longer valid. (@​kassens) in #25162 For example, in

  function _Component() {
    useState()
    ^^^^^^^^ A React Hook "useState" is called in function "_Component" which is neither a Component nor a custom React Hook function.
  }

  _Component should be renamed to Component.

• Add support for ESLint v9. (@​eps1lon in #28773)
• Consider dispatch from useActionState stable. (@​eps1lon in #29665)
• Accept as expression in callback. (@​StyleShit in #28202)
• Accept as expressions in deps array. (@​StyleShit in #28189)
• Treat React.use() the same as use(). (@​kassens in #27769)
• Move use() lint to non-experimental. (@​kassens in #27768)
• Support Flow as expressions. (@​cpojer in #27590)
• Allow useEffect(fn, undefined). (@​kassens in #27525)
• Disallow hooks in async functions. (@​acdlite in #27045)
• Rename experimental useEvent to useEffectEvent. (@​sebmarkbage in #25881)
• Lint for presence of useEvent functions in dependency lists. (@​poteto in #25512)
• Check useEvent references instead. (@​poteto in #25319)
• Update RulesOfHooks with useEvent rules. (@​poteto in #25285)

Changelog

Sourced from eslint-plugin-react-hooks's changelog.

7.1.1

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

• Add deprecated no-op component-hook-factories rule for backwards compatibility. (@​mofeiZ in #36307)

7.1.0

This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better set-state-in-effect detection, improved ref validation, and more helpful error reporting.

• Add ESLint v10 support. (@​azat-io in #35720)
• Skip compilation for non-React files to improve performance. (@​josephsavona in #35589)
• Fix exhaustive deps bug with Flow type casting. (@​jorge-cab in #35691)
• Fix useEffectEvent checks in component syntax. (@​jbrown215 in #35041)
• Improved set-state-in-effect validation with fewer false negatives. (@​jorge-cab in #35134, @​josephsavona in #35147, @​jackpope in #35214, @​chesnokov-tony in #35419, @​jsleitor in #36107)
• Improved ref validation for non-mutating functions and event handler props. (@​josephsavona in #35893, @​kolvian in #35062)
• Compiler now reports all errors instead of stopping at the first. (@​josephsavona in #35873–#35884)
• Improved source locations and error display in compiler diagnostics. (@​nathanmarks in #35348, @​josephsavona in #34963)

7.0.1

• Disallowed passing inline useEffectEvent values as JSX props to guard against accidental propagation. (#34820 by @​jf-eirinha)
• Switch to export = so eslint-plugin-react-hooks emits correct types for consumers in Node16 ESM projects. (#34949 by @​karlhorky)
• Tightened the typing of configs.flat so the configs export is always defined. (#34950 by @​poteto)
• Fix named import runtime errors. (#34951, #34953 by @​karlhorky)

7.0.0

This release slims down presets to just 2 configurations (recommended and recommended-latest), and all compiler rules are enabled by default.

• Breaking: Removed recommended-latest-legacy and flat/recommended configs. The plugin now provides recommended (legacy and flat configs with all recommended rules), and recommended-latest (legacy and flat configs with all recommended rules plus new bleeding edge experimental compiler rules). (@​poteto in #34757)

6.1.1

Note: 6.1.0 accidentally allowed use of recommended without flat config, causing errors when used with ESLint v9's defineConfig() helper. This has been fixed in 6.1.1.

• Fix recommended config for flat config compatibility. The recommended config has been converted to flat config format. Non-flat config users should use recommended-legacy instead. (@​poteto in #34700)
• Add recommended-latest and recommended-latest-legacy configs that include React Compiler rules. (@​poteto in #34675)
• Remove unused NoUnusedOptOutDirectives rule. (@​poteto in #34703)
• Remove hermes-parser and dependency. (@​poteto in #34719)
• Remove @babel/plugin-proposal-private-methods dependency. (@​ArnaudBarre and @​josephsavona in #34715)
• Update for Zod v3/v4 compatibility. (@​kolian and @​josephsavona in #34717)

6.1.0

Note: Version 6.0.0 was mistakenly released and immediately deprecated and untagged on npm. This is the first official 6.x major release and includes breaking changes.

• Breaking: Require Node.js 18 or newer. (@​michaelfaith in #32458)
• Breaking: Flat config is now the default recommended preset. Legacy config moved to recommended-legacy. (@​michaelfaith in #32457)
• New Violations: Disallow calling use within try/catch blocks. (@​poteto in #34040)

... (truncated)

Commits

• See full diff in compare view

---

Note

Overview
Upgrades eslint-plugin-react-hooks in internal/dev_server/ui from 4.6.2 to 7.1.1, with matching package-lock.json updates.

The lockfile reflects the plugin’s new requirements: Node ≥18, broader ESLint peer support (including v9/v10), and added transitive deps (hermes-parser, zod, etc.). No ESLint config or app source changes are in this diff—only the declared dev dependency version.

^{Reviewed by Cursor Bugbot for commit d16c1ce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ld-ahartmann]

Approved.

[cursor]

Dependency verification: NEEDS A HUMAN DECISION

Risk tier high · ecosystems: npm-ui · head d16c1ce tested as merged into main @ d6105ef

Decisions for a human

Verification is complete for these items. Each one needs a choice, not more checks.

1. Remove eslint-plugin-react-hooks from package.json instead of updating it?
   • Nothing in src/, the build configuration, or the package scripts uses eslint-plugin-react-hooks. The update has no effect at run time.
   • Remove unused dependencies instead of bumping them: eslint-plugin-react-hooks

Incomplete verification

This item is not a decision and not a problem in this PR. A rerun of the failed CI job closes it.

• CI results on the PR head: the Go build job (run 38985543546) failed in TestStreamClientV2Handler (internal/dev_server/sdk) with context deadline exceeded after 10 s. This PR changes only internal/dev_server/ui/package.json and package-lock.json, and no Go test reads them. The same two subtests failed the same way on another branch on 2026-10-15 (run 38753901660). On main @ d6105ef without this PR, go test -race -run TestStreamClientV2Handler -count=200 -cpu 1,2 ./internal/dev_server/sdk/ under CPU load gives the same failure. The verifier counts this as a block, but the test is flaky on main. The Go job on main @ d6105ef passed.

Updates

Package	From	To	Change	Ecosystem	Tier
eslint-plugin-react-hooks	4.6.2	7.1.1	major	npm-ui, dev	high

4 transitive update(s)

• hermes-estree ∅ → 0.25.1 (added)
• hermes-parser ∅ → 0.25.1 (added)
• zod ∅ → 4.6.5 (added)
• zod-validation-error ∅ → 4.0.2 (added)

What the verifier checked

Check	Result	Summary
PR merges cleanly and changes only dependency files	pass	Merges cleanly into main; only dependency manifests changed
CI results on the PR head	FAIL (flaky test on main, rerun)	Failing on PR head d16c1ce: Go (failure in 1 job(s)), build (failure). The failing test also fails on main. See Incomplete verification
No dependency goes to a lower version than base	pass	No downgrades
Upstream release notes and diff of each direct update	pass (note)	Upstream notes cover the full range for 1 of 1 direct update(s); notes mention: breaking (1), deprecation (1), requirements (1). The impact review must cover them
Transitive dependency changes (new, removed, major, install scripts)	pass (note)	npm-ui: 1 changed (1 major), 4 added, 0 removed
Licenses of new and changed dependencies	pass	All 5 added or changed dependencies use a license in the policy, with no license change
npm ci resolves (no ERESOLVE or peer conflicts)	pass	npm ci succeeds
UI lint (eslint)	pass	eslint clean
UI format (prettier --check)	pass	prettier --check clean (3.8.4)
UI tests (vitest)	pass	vitest passes (5 passed)
UI builds, and the committed dist/ is current	pass	Build succeeds; committed dist/ matches
npm ls: the dependency tree is valid (peers satisfied)	fails on base too	npm ls reports 2 problem(s): invalid: react@18.3.1;invalid: react-dom@18.3.1
npm audit (runtime dependencies): no new advisories	pass	No new advisories (base 25, PR 25 advisories)
The updated UI dependencies are used	decision	Nothing in src/, the build configuration, or the package scripts uses eslint-plugin-react-hooks. The update has no effect at run time.
Binary smoke test: --version, help for all commands, dev-server serves the UI and API	pass	--version, --help for 419 commands, dev-server UI and API all OK

Already failing on main (not caused by this PR)

• npm ls: the dependency tree is valid (peers satisfied): npm ls reports 2 problem(s): invalid: react@18.3.1;invalid: react-dom@18.3.1

Generated checks

A generated check counts only when it fails on the old version and passes on the new one. 0 of 1 proven.

Check	Kind	Base	PR	Outcome
The UI ESLint configuration does not load eslint-plugin-react-hooks	guard	pass	pass	holds on both

Impact review

eslint-plugin-react-hooks 4.6.2 → 7.1.1 is a devDependency that nothing loads. internal/dev_server/ui/eslint.config.js does not import it, and the resolved ESLint configuration has no react-hooks plugin or rule on either version. The 5.x to 7.x breaking changes (Node 18, flat config as the default recommended preset, preset renames, React Compiler rules in recommended, new violations) therefore change no lint result, test, or build. The update adds 4 MIT dev-only packages (hermes-estree, hermes-parser, zod, zod-validation-error). The question is the one that ui-dep-usage asks: remove the package instead of updating it.

• eslint-plugin-react-hooks 4.6.2..7.1.1: 5.0.0: new violations (component names must start with an uppercase letter, hooks in async functions), ESLint 9 support. 5.2.0: flat config support, TypeScript types. 6.0.0: released by mistake and deprecated. 6.1.0 (breaking): Node >=18, flat config is the default recommended preset, new violations for use() in try/catch and useEffectEvent in closures. 6.1.1: recommended-latest with React Compiler rules. 7.0.0 (breaking): only recommended and recommended-latest presets, all compiler rules on by default. 7.0.1: useEffectEvent JSX prop check, export = types. 7.1.0: ESLint 10 support, better set-state-in-effect and ref validation. 7.1.1: no-op component-hook-factories rule restored. Peer eslint ^3 to ^10, so eslint 8.57.0 is supported. (breaking) (source)
• Upstream behavior changes that reach ldcli: no
• Note: Not reachable: the guard reads eslint --print-config for src/App.tsx and eslint.config.js on both sides and finds no react-hooks plugin or rule. ui-lint, ui-prettier, ui-test, and ui-build-drift pass on the PR, and the committed dist/ matches a fresh build. (generated/ui-react-hooks-not-loaded.sh (guard), internal/dev_server/ui/eslint.config.js)
• Note: Evidence for the removal question: if a follow-up enabled the plugin instead, its recommended rules report 5 exhaustive-deps warnings on 4.6.2, and the same 5 warnings plus 7 set-state-in-effect errors on 7.1.1 (for example src/ProjectSelector.tsx:56). The lint script uses --max-warnings 0, so enabling it on either version would need source changes first. Keeping the update gives no benefit until someone enables the plugin. (generated/ui-react-hooks-not-loaded.sh (detail lines on base and PR))
• Note: New transitive packages, all MIT and dev-only, with no install scripts: hermes-estree 0.25.1, hermes-parser 0.25.1, zod 4.6.5, zod-validation-error 4.0.2. @babel/core and @babel/parser were already in the tree. engines node >=18 is satisfied by the CI Node (lts/*). (state/checks/transitive-changes/pr/details.md, state/checks/license-changes/pr/details.md)

Check details

ci-status

Workflows that PR CI must run on d16c1ce, and their runs on that commit:

Workflow	Event	Run	Result
.github/workflows/dependency-scan.yml	pull_request	38985543570 2026-10-17	pass: success
.github/workflows/dev-server-ui.yml	pull_request	38985543539 2026-10-17	pass: success
.github/workflows/go.yml	pull_request	38985543546 2026-10-17	FAIL: failure in 1 job(s)
.github/workflows/lint-pr-title.yml	pull_request_target	38985567432 2026-10-17	pass: success

• Correction: the go.yml failure is TestStreamClientV2Handler in internal/dev_server/sdk, a flaky test on main. It is not caused by this PR. See Incomplete verification.
• Check Cursor Bugbot: success
• Check Require additional human oversight on bot PRs: success
• Check semgrep-cloud-platform/scan: success

upstream-changes

• eslint-plugin-react-hooks 4.6.2 → 7.1.1: facebook/react, 4744 commits, 300 files, notes: packages/eslint-plugin-react-hooks/CHANGELOG.md, full range, mentions: breaking (6), deprecation (2), requirements (2)

transitive-changes

• npm-ui (package-lock.json): 1 changed, 4 added, 0 removed
  • eslint-plugin-react-hooks 4.6.2 → 7.1.1 (major)
  • added hermes-estree@0.25.1
  • added hermes-parser@0.25.1
  • added zod-validation-error@4.0.2
  • added zod@4.6.5

license-changes

• eslint-plugin-react-hooks@7.1.1: MIT (dev only)
• hermes-estree@0.25.1: MIT (dev only)
• hermes-parser@0.25.1: MIT (dev only)
• zod-validation-error@4.0.2: MIT (dev only)
• zod@4.6.5: MIT (dev only)

ui-npm-ci

• node v22.22.2, npm 10.9.7. CI uses node-version: lts/*.

ui-npm-ls

npm error invalid: react@18.3.1 internal/dev_server/ui/node_modules/react
npm error invalid: react-dom@18.3.1 internal/dev_server/ui/node_modules/react-dom

ui-dep-usage

• eslint-plugin-react-hooks requires node >=18
• eslint-plugin-react-hooks peers: eslint@^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0
• eslint-plugin-react-hooks is not imported in src/ or referenced by tooling

binary-smoke

• ldcli --version: ldcli version dev
• dev-server served /ui/ (1160 KB) and /dev/projects ([])

generated: ui-react-hooks-not-loaded

• eslint-plugin-react-hooks 7.1.1: the resolved configuration for src/App.tsx and eslint.config.js has no react-hooks plugin or rule
• If a follow-up enabled the recommended rules of 7.1.1: react-hooks/exhaustive-deps (warning): 5, react-hooks/set-state-in-effect (error): 7

_{Generated by scripts/dependency-pr/verify.sh (profile full) at 2026-10-17T00:29:59Z. The verifier does not approve or merge.}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.