Bump @eslint/eslintrc from 3.2.0 to 3.3.6 in /js

[dependabot]

Bumps @eslint/eslintrc from 3.2.0 to 3.3.6.

Release notes

Sourced from @​eslint/eslintrc's releases.

eslintrc: v3.3.6

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

eslintrc: v3.3.5

3.3.5 (2026-03-04)

Bug Fixes

• update dependency minimatch to ^3.1.5 (#227) (3dc2381)

eslintrc: v3.3.4

3.3.4 (2026-02-22)

Bug Fixes

• update ajv to 6.14.0 to address security vulnerabilities (#221) (9139140)
• update minimatch to 3.1.3 to address security vulnerabilities (#224) (30339d0)

eslintrc: v3.3.3

3.3.3 (2025-11-28)

Bug Fixes

• release v3.3.3 because publishing v3.3.2 failed (#211) (8aa555a)

eslintrc: v3.3.2

3.3.2 (2025-11-25)

Bug Fixes

• Remove name property from all and recommended configs (#200) (344da49)

v3.3.1

3.3.1 (2025-03-11)

Bug Fixes

• correct types field in package.json (#184) (2f4cf3f)

v3.3.0

... (truncated)

Changelog

Sourced from @​eslint/eslintrc's changelog.

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

3.3.5 (2026-03-04)

Bug Fixes

• update dependency minimatch to ^3.1.5 (#227) (3dc2381)

3.3.4 (2026-02-22)

Bug Fixes

• update ajv to 6.14.0 to address security vulnerabilities (#221) (9139140)
• update minimatch to 3.1.3 to address security vulnerabilities (#224) (30339d0)

3.3.3 (2025-11-28)

Bug Fixes

• release v3.3.3 because publishing v3.3.2 failed (#211) (8aa555a)

3.3.2 (2025-11-25)

Bug Fixes

• Remove name property from all and recommended configs (#200) (344da49)

3.3.1 (2025-03-11)

Bug Fixes

• correct types field in package.json (#184) (2f4cf3f)

3.3.0 (2025-02-21)

Features

• Add types to package (#179) (cb546be)

Commits

• b433a22 chore: release 3.3.6 🚀 (#236)
• 0c5de74 fix: update js-yaml to 4.3.0 to address security vulnerability (#235)
• 94837a4 docs: Update README sponsors
• dbae1a1 docs: Update README sponsors
• 19fe72a docs: Update README sponsors
• 92ebd17 docs: Update README sponsors
• 3ba4c8c ci: add Node.js 26 to CI (#231)
• f8d268a docs: Update README sponsors
• 6e20867 docs: Update README sponsors
• 6d722b6 docs: Update README sponsors
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​eslint/eslintrc since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: area/dependencies, team/ui. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The update to @eslint/eslintrc is correctly implemented. However, the analysis of js/pnpm-lock.yaml identified four security vulnerabilities that should be addressed before merging, as they introduce significant risk to the application. Most critical is a Remote Code Execution (RCE) vulnerability in simple-git (CVE-2026-6951). Additionally, vulnerabilities related to out-of-bounds writes, path traversal, and open redirects were found in uuid, i18next-http-backend, and react-router. Although Codacy identifies the PR as up to standards, these security flaws represent mandatory fixes.

4 comments outside of the diff

js/pnpm-lock.yaml

_{line 310 🔴 HIGH RISK}
A Remote Code Execution (RCE) vulnerability (CVE-2026-6951) was detected in simple-git@3.27.0. This is a critical security risk where an attacker could execute arbitrary commands through crafted git operations. Update simple-git to version 3.36.0 or later.

_{line 467 🟡 MEDIUM RISK}
The dependency uuid@11.0.5 is vulnerable to an out-of-bounds write (CVE-2026-41907). This flaw can potentially be exploited to impact data integrity. Update uuid to version 11.1.1.

_{line 95 🟡 MEDIUM RISK}
i18next-http-backend@3.0.2 is vulnerable to Path Traversal and URL Injection (CVE-2026-41691) via unsanitised lng/ns parameters. Update i18next-http-backend to version 3.0.5.

_{line 116 🟡 MEDIUM RISK}
react-router@6.29.0 contains an open redirect vulnerability (CVE-2026-40181) via specially crafted URLs. Update react-router-dom to version 6.30.4 or later.

Test suggestions

• Verify that ESLint still successfully loads configurations and executes linting after the @eslint/eslintrc upgrade

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that ESLint still successfully loads configurations and executes linting after the @eslint/eslintrc upgrade

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}