chore(deps): refresh bundled plugins on the eslint 9 line

[stevensacks]

Bumps every bundled dependency that still supports the ESLint 9 line, and ships a minor changeset.

Why minor and not patch

I diffed the resolved rule set before and after, using ESLint's own calculateConfigForFile across the full composed bundle (base, react, reactRouter, styleHygiene, guardrails, testing, storybook, playwright, betterTailwind, prettier) over seven representative file paths.

Twelve rules land at error severity that were not enabled before.

Eleven were added to eslint-plugin-sonarjs's recommended in 4.2.0, which guardrails spreads wholesale:

assertions-in-test-cases, explicit-test-skip, memoize-cache-key, no-debug-commands-in-ui-tests, no-default-utility-imports, no-fixed-wait-in-tests, no-interpolation-in-inline-snapshots, no-mixed-completion-style, parameterized-tests, prefer-native-lodash-alternative, synchronous-suite-callback

The twelfth is playwright/no-unnecessary-assertions, added to flat/recommended in eslint-plugin-playwright 2.11.0 and live under .playwright/.

Worth noting: the SonarJS additions read as test rules by name, but they ship in the base recommended set rather than a test-scoped one, so they resolve for every linted file, not only specs.

New errors reaching consumers is exactly what 1.10.0 and 1.11.0 shipped as minors. Major has been reserved for changes that require a config edit, and nothing here does.

Real-world cost

Ran the twelve new rules against GAIA's tree. Three findings, all sonarjs/parameterized-tests:

• app/pages/Public/IndexPage/tests/index.test.tsx:67
• test/primary-contrast.test.ts:100
• test/primary-contrast.test.ts:105

None of the twelve is auto-fixable, so each needs a real edit or a deliberate suppression.

Relaxations

eslint-config-airbnb-extended 3.1.0 to 3.2.0 only relaxes: drizzle.config.* joins the import-x/no-extraneous-dependencies devDependencies allowlist.

Peer note

eslint-plugin-storybook 10.4.6 to 10.5.7 tightens its own peer on storybook to ^10.5.7. A project on an earlier 10.5.x sees an unmet-peer warning until it bumps. Not fatal unless strictPeerDependencies is on. GAIA is currently on storybook 10.5.4 and will clear this on its next dependency run.

Held back deliberately

• eslint 10, @eslint/js 10, and eslint-plugin-unicorn 73 (peers eslint >=10.4) all require widening the eslint: ^9.0.0 peer range. They move together as one major.
• TypeScript 7 is blocked independently: typescript-eslint 8.x peers typescript >=4.8.4 <6.1.0.
• @changesets/cli 2 to 3 and @changesets/changelog-github 0.7 to 1.0 are dev-only, but swapping the release tool during a release adds risk for no gain. Separate change.

Verification

• pnpm typecheck clean
• pnpm lint (--max-warnings=0) clean
• vitest run: 38/38 passing
• pnpm build succeeds

🤖 Generated with Claude Code