build(deps-dev): bump @eslint-react/eslint-plugin from 5.23.3 to 5.23.5

[dependabot]

Bumps @eslint-react/eslint-plugin from 5.23.3 to 5.23.5.

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.23.5 (2026-10-03)

What's Changed

🐞 Fixes

• react-x/set-state-in-effect: the ref-derived value exemption now also covers setState calls reached indirectly through functions or hook callbacks invoked from the effect setup, not only setState written directly in the setup body. (#1982)
• react-x/set-state-in-effect: more ref read shapes are recognized as ref-derived values — <ref-named>.current anywhere in a member chain, locals derived from other ref-derived locals, and reads through a ref/xxxRef parameter. (#1982)
• react-web-api/no-leaked-event-listener: removeEventListener inside a function called from the effect cleanup now pairs with its addEventListener, fixing false positives for listeners removed on unmount; cleanup calls resolve to the actual functions, so same-named shadowed functions no longer pair by coincidence. (#1982)

🏗️ Internal

• Bumped effect to 4.0.0 and migrated the repo scripts to the v4 APIs. (#1981)

Full Changelog: Rel1cx/eslint-react@v5.23.4...v5.23.5

Attestation

https://github.com/Rel1cx/eslint-react/attestations/52275386

v5.23.4 (2026-10-03)

What's Changed

🐞 Fixes

• Added the missing react-x/static-components rule to the disable-experimental preset. (#1980)
• Fixed type imports in react-x/exhaustive-deps and react-x/rules-of-hooks (RuleFeature is now imported from @eslint-react/eslint instead of @eslint-react/shared).

📝 Documentation

• react-jsx/no-useless-fragment: clarified the scope of the allowExpressions option and unified experimental-rule callout wording across rule docs.
• react-x: unified cross-rule references in rule docs to full rule names.
• Removed low-relevance entries from the further reading sections of rule docs, and removed a redundant note about eslint being an optional peer dependency.
• Fixed inaccuracies in internal documentation. (#1980)

🏗️ Internal

• Adopted ts-pattern for type checks in @eslint-react/core, @eslint-react/jsx, and the react-dom plugin, and declared the missing ts-pattern dependencies.
• Added behavior boundary tests for react-jsx/no-useless-fragment.
• Bumped fumadocs-core, fumadocs-ui, and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.23.3...v5.23.4

Attestation

https://github.com/Rel1cx/eslint-react/attestations/52237942

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.23.5 (2026-10-03)

🐞 Fixes

• react-x/set-state-in-effect: the ref-derived value exemption now also covers setState calls reached indirectly through functions or hook callbacks invoked from the effect setup, not only setState written directly in the setup body. (#1982)
• react-x/set-state-in-effect: more ref read shapes are recognized as ref-derived values — <ref-named>.current anywhere in a member chain, locals derived from other ref-derived locals, and reads through a ref/xxxRef parameter. (#1982)
• react-web-api/no-leaked-event-listener: removeEventListener inside a function called from the effect cleanup now pairs with its addEventListener, fixing false positives for listeners removed on unmount; cleanup calls resolve to the actual functions, so same-named shadowed functions no longer pair by coincidence. (#1982)

🏗️ Internal

• Bumped effect to 4.0.0 and migrated the repo scripts to the v4 APIs. (#1981)

Full Changelog: Rel1cx/eslint-react@v5.23.4...v5.23.5

v5.23.4 (2026-10-03)

🐞 Fixes

• Added the missing react-x/static-components rule to the disable-experimental preset. (#1980)
• Fixed type imports in react-x/exhaustive-deps and react-x/rules-of-hooks (RuleFeature is now imported from @eslint-react/eslint instead of @eslint-react/shared).

📝 Documentation

• react-jsx/no-useless-fragment: clarified the scope of the allowExpressions option and unified experimental-rule callout wording across rule docs.
• react-x: unified cross-rule references in rule docs to full rule names.
• Removed low-relevance entries from the further reading sections of rule docs, and removed a redundant note about eslint being an optional peer dependency.
• Fixed inaccuracies in internal documentation. (#1980)

🏗️ Internal

• Adopted ts-pattern for type checks in @eslint-react/core, @eslint-react/jsx, and the react-dom plugin, and declared the missing ts-pattern dependencies.
• Added behavior boundary tests for react-jsx/no-useless-fragment.
• Bumped fumadocs-core, fumadocs-ui, and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.23.3...v5.23.4

Commits

• d13434b release: 5.23.5
• 8db7dce release: 5.23.4
• a6642d7 docs: remove redundant note about eslint as optional peer dependency
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mergify]

Automatically approving dependabot

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.