Bump @typescript-eslint/eslint-plugin from 8.58.2 to 8.59.0

[dependabot]

Bumps @typescript-eslint/eslint-plugin from 8.58.2 to 8.59.0.

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.59.0

8.59.0 (2026-04-20)

🚀 Features

• eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789)

❤️ Thank You

• Ulrich Stark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.59.0 (2026-04-20)

🚀 Features

• eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789)

❤️ Thank You

• Ulrich Stark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• ea9ae4f chore(release): publish 8.59.0
• cfca550 feat(eslint-plugin): [no-unnecessary-type-assertion] report more cases based ...
• 6d599b4 chore(eslint-plugin): switch auto-generated test cases to hand-written in ret...
• 33c8169 chore: fix cspell violations in code blocks (#12167)
• See full diff in compare view

[fossabot]

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because the new version of @​typescript-eslint/eslint-plugin declares engine support for Node 18, 20, and 21, while the project targets Node 24 — a mismatch that warrants verification. In practice, since this is a pure developer-tooling dependency with no runtime footprint, Node 24 will almost certainly work without issue; however, the discrepancy should be confirmed. Outside of this compatibility flag, the upgrade is low-risk: it carries only an internal bump of @​typescript-eslint/scope-manager and one bug fix, introduces no breaking changes to the TypeScript-ESLint rules configured in eslint.config.mjs or the inline suppressions in src/index.ts, and no security vulnerabilities are present in the target version. The separately reported malicious package (@​typescript_eslinter/eslint) is an entirely different package with a different scope and name and has no bearing on this legitimate upgrade.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 1 fixable issue in this upgrade.

• Verify that the upgraded @​typescript-eslint/eslint-plugin@​8.59.0 works correctly with Node 24 by running the ESLint linter against the project. Run 'npx eslint .' from the repo root. If it passes with no unexpected errors, the Node engine mismatch (package declares 18/20/21, project uses >=24) is a non-issue in practice. Alternatively, manually inspect the output of 'node -v' and 'npx eslint --print-config eslint.config.mjs' to confirm the plugin loads correctly.
  Run: npx eslint .
  Files: eslint.config.mjs, src/index.ts

AI Assistant Prompt

Copy prompt for AI assistant

# Dependency Upgrade Verification: @​typescript-eslint/eslint-plugin → 8.59.0

## Context
We're upgrading `@​typescript-eslint/eslint-plugin` in the `fossa-action` repository (PR #298). The upgrade includes:
- Enhanced `no-unnecessary-type-assertion` rule with improved assignability detection
- Internal bump of `@​typescript-eslint/scope-manager`
- No breaking changes

## Key Concern
The new package declares Node engine support for 18, 20, and 21, but this project targets **Node 24**. Since this is a dev-only linting dependency with no runtime footprint, it's very likely fine — but we need to verify.

## What I Need You To Do

### 1. Run ESLint to confirm compatibility
Run the linter from the repo root to verify the upgraded plugin works on Node 24:
```bash
npx eslint .
```

### 2. If ESLint passes with no unexpected errors
The Node engine mismatch is a non-issue. No code changes are needed.

### 3. If ESLint reports new lint errors
The `no-unnecessary-type-assertion` rule now catches additional cases. Check these files for potential new violations:
- `src/index.ts` (has existing `@​typescript-eslint` inline suppressions)
- Any `.ts` files with type assertions (e.g., `as Type` or `!` non-null assertions)

For each new error, either:
- **Fix the code** by removing the unnecessary type assertion (preferred), or
- **Add an inline suppression** with `// eslint-disable-next-line @​typescript-eslint/no-unnecessary-type-assertion` if the assertion is intentional

### 4. Verify plugin loads correctly
```bash
node -v
npx eslint --print-config eslint.config.mjs
```
Confirm the plugin loads without errors and the TypeScript-ESLint rules (like `@​typescript-eslint/naming-convention`, `@​typescript-eslint/array-type`, `@​typescript-eslint/no-use-before-define`) are still active in the config.

## Files to Review
- `eslint.config.mjs` — ESLint configuration with `@​typescript-eslint/eslint-plugin` and `@​typescript-eslint/parser`
- `src/index.ts` — Contains inline `@​typescript-eslint` rule suppressions

What we checked

• Dependency declared as "^8.59.0" in devDependencies. The project's own Node engine requirement is >= 24.0.0 (line 12), while the new package version only lists Node 18, 20, and 21 as supported engines — a technical mismatch that should be verified before merging. ^[1]
• Project's engines field specifies ">= 24.0.0", which is newer than the Node versions the upgraded package explicitly supports (18, 20, 21). Confirms the runtime version mismatch flagged in the runtime context. ^[2]
• @​typescript-eslint/eslint-plugin is imported and used as the @​typescript-eslint plugin (line 32). Rules like @​typescript-eslint/naming-convention (line 67), @​typescript-eslint/array-type (line 163), and @​typescript-eslint/no-use-before-define (line 201) are actively configured — these are all stable, well-established rules with no reported changes in this upgrade. ^[3]
• Config extends plugin:@​typescript-eslint/eslint-recommended and plugin:@​typescript-eslint/recommended via FlatCompat. These presets continue to be provided in the upgraded version with no breaking changes detected. ^[4]
• Inline // eslint-disable-next-line @​typescript-eslint/naming-convention suppression for FOSSA_API_KEY usage. This pattern remains fully supported in the upgraded version. ^[5]
• Second inline // eslint-disable-next-line @​typescript-eslint/naming-convention suppression, also for FOSSA_API_KEY. No changes to rule behavior detected in the upgrade. ^[6]
• A typosquatting package @​typescript_eslinter/eslint (different scope and naming) impersonates @​typescript-eslint/eslint-plugin. The legitimate package being upgraded is NOT affected. Developers should ensure they are not accidentally referencing the malicious package name, which was removed from npm December 1, 2024. ^[7]
• Sonatype confirmed the typosquatting campaign (sonatype-2024-013026) targets users of @​typescript-eslint/eslint-plugin but does not compromise the legitimate package itself. A companion fake @​typescript_eslinter/prettier remained live after the primary fake was removed — no action needed for this upgrade, but general awareness is warranted. ^[8]

Dependency Usage

@​typescript-eslint/eslint-plugin is a developer tooling dependency used exclusively within the project's linting infrastructure, configured in eslint.config.mjs alongside @​typescript-eslint/parser. It enforces a comprehensive set of TypeScript-specific code quality rules across the codebase — including @​typescript-eslint/naming-convention, @​typescript-eslint/array-type, and @​typescript-eslint/no-use-before-define — with inline rule suppressions also appearing in src/index.ts. This dependency has no runtime impact but plays a foundational role in maintaining code consistency and catching TypeScript-specific issues during development and CI workflows.

• @​typescript-eslint/eslint-plugin is imported and used as the @​typescript-eslint plugin (line 32). Rules like @​typescript-eslint/naming-convention (line 67), @​typescript-eslint/array-type (line 163), and @​typescript-eslint/no-use-before-define (line 201) are actively configured — these are all stable, well-established rules with no reported changes in this upgrade.
  eslint.config.mjs:3
• Config extends plugin:@​typescript-eslint/eslint-recommended and plugin:@​typescript-eslint/recommended via FlatCompat. These presets continue to be provided in the upgraded version with no breaking changes detected.
  eslint.config.mjs:22

View 2 more usages

• Inline // eslint-disable-next-line @​typescript-eslint/naming-convention suppression for FOSSA_API_KEY usage. This pattern remains fully supported in the upgraded version.
  src/index.ts:74
• Second inline // eslint-disable-next-line @​typescript-eslint/naming-convention suppression, also for FOSSA_API_KEY. No changes to rule behavior detected in the upgrade.
  src/index.ts:141

Changes

@​typescript-eslint/eslint-plugin was updated with an enhanced no-unnecessary-type-assertion rule that now reports additional cases based on improved assignability detection, along with a spelling fix in code blocks. The @​typescript-eslint/scope-manager dependency was also bumped in lockstep.

• eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789) (v8.58.2-8.59.0, changelog)
• Ulrich Stark (v8.58.2-8.59.0, changelog)
• chore: fix cspell violations in code blocks (v8.58.2-8.59.0, commit)

View 5 more changes

• feat(eslint-plugin): [no-unnecessary-type-assertion] report more cases based on improved detection (v8.58.2-8.59.0, commit)
• chore(eslint-plugin): switch auto-generated test cases to hand-written ones (v8.58.2-8.59.0, commit)
• chore(deps): update dependency cspell to v9.8.0 (v8.58.2-8.59.0, commit)
• chore(website): redirect from /docs to /getting-started (v8.58.2-8.59.0, commit)
• Updated @​typescript-eslint/scope-manager dependency from 8.58.2 to 8.59.0 (v8.59.0, package source)

References (8)

[1]: Dependency declared as "^8.59.0" in devDependencies. The project's own Node engine requirement is >= 24.0.0 (line 12), while the new package version only lists Node 18, 20, and 21 as supported engines — a technical mismatch that should be verified before merging.

fossa-action/package.json

Line 24 in c17ebf3

"@typescript-eslint/eslint-plugin": "^8.59.0",

[2]: Project's engines field specifies ">= 24.0.0", which is newer than the Node versions the upgraded package explicitly supports (18, 20, 21). Confirms the runtime version mismatch flagged in the runtime context.

fossa-action/package.json

Line 12 in c17ebf3

"node": ">= 24.0.0"

[3]: @​typescript-eslint/eslint-plugin is imported and used as the @​typescript-eslint plugin (line 32). Rules like @​typescript-eslint/naming-convention (line 67), @​typescript-eslint/array-type (line 163), and @​typescript-eslint/no-use-before-define (line 201) are actively configured — these are all stable, well-established rules with no reported changes in this upgrade.

fossa-action/eslint.config.mjs

Line 3 in c17ebf3

import typescriptEslint from "@typescript-eslint/eslint-plugin";

[4]: Config extends plugin:@​typescript-eslint/eslint-recommended and plugin:@​typescript-eslint/recommended via FlatCompat. These presets continue to be provided in the upgraded version with no breaking changes detected.

fossa-action/eslint.config.mjs

Line 22 in c17ebf3

extends: fixupConfigRules(compat.extends(

[5]: Inline // eslint-disable-next-line @​typescript-eslint/naming-convention suppression for FOSSA_API_KEY usage. This pattern remains fully supported in the upgraded version.

fossa-action/src/index.ts

Line 74 in c17ebf3

// eslint-disable-next-line @typescript-eslint/naming-convention

[6]: Second inline // eslint-disable-next-line @​typescript-eslint/naming-convention suppression, also for FOSSA_API_KEY. No changes to rule behavior detected in the upgrade.

fossa-action/src/index.ts

Line 141 in c17ebf3

// eslint-disable-next-line @typescript-eslint/naming-convention

[7]: A typosquatting package @​typescript_eslinter/eslint (different scope and naming) impersonates @​typescript-eslint/eslint-plugin. The legitimate package being upgraded is NOT affected. Developers should ensure they are not accidentally referencing the malicious package name, which was removed from npm December 1, 2024. (source link)

[8]: Sonatype confirmed the typosquatting campaign (sonatype-2024-013026) targets users of @​typescript-eslint/eslint-plugin but does not compromise the legitimate package itself. A companion fake @​typescript_eslinter/prettier remained live after the primary fake was removed — no action needed for this upgrade, but general awareness is warranted. (source link)

---

fossabot analyzed this PR using static analysis and dependency research. View this analysis on the web

[dependabot]

Superseded by #301.