[Snyk] Security upgrade eslint from 9.39.4 to 10.0.0

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• packages/server/package.json

⚠️ Warning

Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Inefficient Algorithmic Complexity SNYK-JS-BRACEEXPANSION-17706650

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

---

This change is 

[snyk-io]

This major upgrade to ESLint v10 introduces significant breaking changes, most notably the complete removal of the legacy .eslintrc configuration system. All projects must migrate to the eslint.config.js (flat config) format.

Key Breaking Changes:

• Removal of .eslintrc: Support for .eslintrc.* and .eslintignore files has been completely removed. [1, 2, 7] You must migrate to a eslint.config.js file. [5, 10] Related CLI flags like --no-eslintrc and --ignore-path are also removed. [1]
• Node.js Version Requirement: Support for Node.js versions older than v20.19.0 has been dropped. [1, 2] You must ensure your environment is running a compatible Node.js version. [5]
• New Config Lookup: The configuration file is now located by searching from the directory of each linted file, which is a change from the previous behavior of searching from the current working directory. [1, 6]
• eslint-env Comments: Using /* eslint-env */ comments will now cause linting errors. [2, 5]

Recommendation:
This upgrade requires a mandatory migration of your ESLint configuration from the legacy .eslintrc format to the modern eslint.config.js flat config format. Follow the official Configuration Migration Guide before upgrading. [2, 10]

Source: ESLint v10.0.0 Release Notes, Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[kilo-code-bot]

[CRITICAL]: pnpm-lock.yaml is not updated for this dependency change and CI install will fail

This PR hardcodes "eslint": "10.0.0" here, but pnpm-lock.yaml is unchanged on the branch and still resolves eslint@9.39.4 everywhere (confirmed: no eslint@10 entry in the lockfile). pnpm's default --frozen-lockfile (used in CI) will reject the mismatch and the packages/server install/build/lint steps will fail. Snyk's own PR warning called this out: *"Failed to update the pnpm-lock.yaml, please update manually before merging."

Before this can merge, run pnpm install so the lockfile records eslint@10.0.0, and commit the regenerated pnpm-lock.yaml.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

[WARNING]: Hardcoding 10.0.0 diverges from the catalog:devTools eslint and creates version skew with sibling packages

The repo uses a pnpm catalog: eslint: ^9.39.2 is defined in pnpm-workspace.yaml and every other package pulls eslint via catalog:devTools. Pinning a bare 10.0.0 here forks @modelcontextprotocol/server off the catalog, so it will run a different major of eslint than client, core-internal, core, etc. This defeats the catalog's purpose (single-source version management) and is easy to regress on the next catalog bump.

Consider either (a) updating the catalog eslint entry to 10.0.0 (and bumping the whole workspace together), or (b) keeping catalog:devTools and updating the catalog value — rather than a one-off hardcoded version in a single package.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

[WARNING]: ESLint v10 is a major bump; companion devDeps remain pinned to v9-era ranges and may be incompatible

eslint-config-prettier, eslint-plugin-n, typescript-eslint, and @eslint/js are still catalog:devTools, which currently resolve to v9-compatible versions (@eslint/js: ^9.39.2, typescript-eslint: ^8.48.1, eslint-plugin-n: ^17.23.1). ESLint v10 drops Node <20.19 and the legacy .eslintrc system; flat-config plugins often require a matching major. Mixing eslint@10 with v9-era companion plugins risks peer-dependency and runtime incompatibilities in pnpm run lint.

Verify the companion lint plugins support eslint@10 (and that this repo's flat config / Node version satisfy v10 requirements) before merging; bump the companions in lockstep if needed.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

[SUGGESTION]: Add a changeset for this dependency change

The repo maintains .changeset/ and uses changesets for releases. A dependency bump (even a dev dependency) normally warrants a changeset so downstream consumers / release notes reflect it. Consider adding a .changeset/*.md describing the eslint major bump in packages/server.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

Code Review Summary

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	2
SUGGESTION	1

Issue Details (click to expand)

CRITICAL

File	Line	Issue
packages/server/package.json	101	pnpm-lock.yaml not updated for the eslint 10.0.0 bump; CI --frozen-lockfile install will fail (lockfile still pins eslint@9.39.4). Run pnpm install and commit the regenerated lockfile.

WARNING

File	Line	Issue
packages/server/package.json	101	Hardcoding 10.0.0 diverges from catalog:devTools (eslint: ^9.39.2 in pnpm-workspace.yaml) and creates version skew vs sibling packages that still use the catalog.
packages/server/package.json	101	ESLint v10 is a major bump; companion lint devDeps (@eslint/js, eslint-plugin-n, typescript-eslint, eslint-config-prettier) remain catalog-pinned to v9-era ranges and may be incompatible. Verify v10 support / bump in lockstep.

SUGGESTION

File	Line	Issue
packages/server/package.json	101	Add a .changeset/*.md describing the dev-dependency major bump.

Files Reviewed (1 files)

• packages/server/package.json - 4 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by hy3-20260706:free · Input: 62K · Output: 4.1K · Cached: 315.6K}

_{Review guidance: REVIEW.md from base branch main}