chore(core): Migrate from ESLint to oxlint

[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Replace ESLint with oxlint for dramatically faster linting. Follows the same migration pattern as sentry-javascript#19134.

What changed

• Added .oxlintrc.json with rule parity to the previous ESLint config
• Uses jsPlugins (experimental) for @sentry-internal/eslint-plugin-sdk custom rules (no-eq-empty, no-focused-tests, no-skipped-tests, no-class-field-initializers, no-regexp-constructor)
• Migrated all eslint-disable inline comments to oxlint-disable format
• Removed unused disable directives (rules already turned off in config)
• Removed ESLint dependencies (eslint, @typescript-eslint/*, eslint-plugin-react, eslint-plugin-react-native, @sentry-internal/eslint-config-sdk)
• Cleaned up ESLint-related yarn resolutions

Performance

Metric	ESLint	oxlint	Speedup
Lint time	~30s	~70ms	~430x
Files	301	301	-
Rules	~50 active	101	-

Known gaps (same as sentry-javascript)

These rules have no oxlint equivalent and are dropped:

• simple-import-sort/imports — import ordering will need manual attention
• @typescript-eslint/naming-convention — PascalCase types, _ prefix on private members
• @typescript-eslint/member-ordering — class field/method ordering
• @typescript-eslint/explicit-member-accessibility — public/private/protected keywords
• @typescript-eslint/unified-signatures — overload consolidation
• @typescript-eslint/typedef — type annotation enforcement

jsPlugin inline disable limitation

Oxlint's experimental jsPlugins feature does not yet support inline disable comments (oxlint-disable-next-line) for JS plugin rules. This affects:

• sdk/no-regexp-constructor — disabled in config; only 2 intentional uses exist with comments explaining why
• sdk/no-skipped-tests — set to warn instead of error; 1 intentional test.skip exists

Not an issue

• eslint-plugin-react-native — was included as a plugin but no rules from it were actually enabled, so dropping it has zero impact

💡 Motivation and Context

• We were on ESLint 9 but with ESLINT_USE_FLAT_CONFIG=false to avoid the flat config migration. ESLint 10 will drop legacy config support entirely.
• sentry-javascript already migrated to oxlint (#19134)
• Linting is ~430x faster, making it practical to run locally on every save
• Aligns tooling across Sentry SDK repos

Closes #5615

💚 How did you test it?

• oxlint runs clean (0 errors, 6 warnings: 5 no-explicit-any + 1 no-skipped-tests — matching previous ESLint behavior)
• yarn build passes
• All 1172 SDK tests pass (103 suites)
• All 186 tools tests pass (9 suites)
• Zero unused disable directives
• Zero remaining eslint-disable comments

📝 Checklist

• I added tests to verify changes
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing
• No breaking changes

🔮 Next steps

• Monitor oxlint releases for jsPlugin inline disable support → re-enable sdk/no-regexp-constructor as error and sdk/no-skipped-tests as error
• Consider adding --deny-warnings once the no-explicit-any warnings are resolved
• Track oxlint support for import sorting, naming conventions

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• chore(core): Migrate from ESLint to oxlint by antonis in #5867

• chore(deps): bump yauzl to ^3.2.1 by antonis in #5855
• chore(deps): bump appium from 2.4.1 to 3.2.2 by antonis in #5856
• fix(ios): Guard replay postInit behind runtime session replay check by antonis in #5858
• Add better needs_web check to CI by alwx in #5863
• chore(deps): bump fast-xml-parser to ^5.5.7 by antonis in #5854
• CI: detect-changes workflow to only check the affected components on the CI side by alwx in #5843
• chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.24.1 to 2.25.0 by dependabot in #5861
• chore(deps): bump getsentry/craft from 2.24.1 to 2.25.0 by dependabot in #5862
• chore(deps): bump github/codeql-action from 4.32.6 to 4.34.1 by dependabot in #5860
• chore(deps): update JavaScript SDK to v10.45.0 by github-actions in #5848
• chore(deps): bump flatted from 3.4.1 to 3.4.2 by dependabot in #5853
• chore(deps): update Cocoa SDK to v9.8.0 by github-actions in #5847
• fix(tracing): Guard getNewScreenTimeToDisplay behind enableTimeToInitialDisplay by antonis in #5849
• chore(deps): bump json from 2.16.0 to 2.17.1.2 in /performance-tests by dependabot in #5844
• chore(docs): Add changelog entry for duplicated breadcrumbs fix by antonis in #5851
• fix(tracing): Unsubscribe spanEnd listeners after they fire to prevent accumulation by antonis in #5840
• fix(android): Properly remove duplicated breadcrumbs by vovkasm in #5841
• fix(tracing): Skip native frames and stall tracking for unsampled spans by antonis in #5842

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against 66bf368