## Summary

Enable 7 eslint-react rules not included in `recommended-typescript` and
fix all violations. Also fix a pre-existing flaky test.

### New ESLint rules enabled

| Rule | Severity | Purpose |
|------|----------|---------|
| `jsx-no-leaked-dollar` | error | Prevent dollar signs leaking into
rendered JSX output |
| `jsx-no-useless-fragment` | warn | Remove unnecessary `<></>` fragment
wrappers |
| `dom-no-missing-button-type` | warn | Require `type` attribute on
`<button>` elements |
| `dom-no-unsafe-target-blank` | error | Require `rel="noopener"` with
`target="_blank"` (security) |
| `no-duplicate-key` | error | Catch duplicate keys in JSX lists |
| `no-unstable-context-value` | warn | Catch unstable context values
causing unnecessary re-renders |
| `no-unstable-default-props` | warn | Catch unstable default props
causing unnecessary re-renders |

Note: `jsx-no-leaked-semicolon` (also new in 4.2.3) is already included
in `recommended-typescript` automatically.

### Violations fixed

- 10 `dom-no-missing-button-type` violations: added `type="button"` to
buttons in Sidebar, StatusBar, guards, stories, and tests

### Flaky test fix

- `client.test.ts > clears auth localStorage keys on 401` was failing
because `VITE_DEV_AUTH_BYPASS=true` in `web/.env` caused the 401
interceptor to skip localStorage clearing in tests. Fixed by mocking
`@/utils/dev` to disable the bypass.

## Test plan

- `npm --prefix web run lint` -- zero warnings
- `npm --prefix web run type-check` -- clean
- `npm --prefix web run test` -- 2341/2341 passing (including the
previously flaky test)

## Context

Follow-up to dependency PRs #1020-#1027 (all merged). The eslint-react
upgrade from 4.2.1 to 4.2.3 added new rules worth enabling.

🤖 I have created a release *beep* *boop*
---


##
[0.5.8](v0.5.7...v0.5.8)
(2026-04-03)


### Features

* auto-select embedding model + fine-tuning pipeline wiring
([#999](#999))
([a4cbc4e](a4cbc4e)),
closes [#965](#965)
[#966](#966)
* ceremony scheduling batch 3 -- milestone strategy, template defaults,
department overrides
([#1019](#1019))
([321d245](321d245))
* five-pillar evaluation framework for HR performance tracking
([#1017](#1017))
([5e66cbd](5e66cbd)),
closes [#699](#699)
* populate comparison page with 53 competitor entries
([#1000](#1000))
([5cb232d](5cb232d)),
closes [#993](#993)
* throughput-adaptive and external-trigger ceremony scheduling
strategies ([#1003](#1003))
([bb5c9a4](bb5c9a4)),
closes [#973](#973)
[#974](#974)


### Bug Fixes

* eliminate backup service I/O from API test lifecycle
([#1015](#1015))
([08d9183](08d9183))
* update run_affected_tests.py to use -n 8
([#1014](#1014))
([3ee9fa7](3ee9fa7))


### Performance

* reduce pytest parallelism from -n auto to -n 8
([#1013](#1013))
([43e0707](43e0707))


### CI/CD

* bump docker/login-action from 4.0.0 to 4.1.0 in the all group
([#1027](#1027))
([e7e28ec](e7e28ec))
* bump wrangler from 4.79.0 to 4.80.0 in /.github in the all group
([#1023](#1023))
([1322a0d](1322a0d))


### Maintenance

* bump github.com/mattn/go-runewidth from 0.0.21 to 0.0.22 in /cli in
the all group
([#1024](#1024))
([b311694](b311694))
* bump https://github.com/astral-sh/ruff-pre-commit from v0.15.8 to
0.15.9 in the all group
([#1022](#1022))
([1650087](1650087))
* bump node from `71be405` to `387eebd` in /docker/sandbox in the all
group ([#1021](#1021))
([40bd2f6](40bd2f6))
* bump node from `cf38e1f` to `ad82eca` in /docker/web in the all group
([#1020](#1020))
([f05ab9f](f05ab9f))
* bump the all group in /web with 3 updates
([#1025](#1025))
([21d40d3](21d40d3))
* bump the all group with 2 updates
([#1026](#1026))
([36778de](36778de))
* enable additional eslint-react rules and fix violations
([#1028](#1028))
([80423be](80423be))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>