[pull] main from formbricks:main

apps/storybook/.storybook/main.ts

@@ -11,6 +11,7 @@ const __dirname = dirname(__filename);
  * This function is used to resolve the absolute path of a package.
  * It is needed in projects that use Yarn PnP or are set up within a monorepo.
  */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- Storybook boilerplate; the return value feeds differently-typed addon/framework fields (migration ENG-1677)
 function getAbsolutePath(value: string): any {
   return dirname(require.resolve(join(value, "package.json")));
 }

apps/storybook/eslint.config.mjs

@@ -0,0 +1,30 @@
+import js from "@eslint/js";
+import reactHooks from "eslint-plugin-react-hooks";
+import reactRefresh from "eslint-plugin-react-refresh";
+import storybook from "eslint-plugin-storybook";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default [
+  { ignores: ["dist/**", "node_modules/**", "storybook-static/**"] },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  // eslint-plugin-react-hooks v7 exposes flat configs under `configs.flat.*`;
+  // the top-level `recommended-latest` is the legacy (eslintrc) format and crashes ESLint 9.
+  reactHooks.configs.flat.recommended,
+  ...storybook.configs["flat/recommended"],
+  {
+    languageOptions: {
+      globals: {
+        ...globals.browser,
+        ...globals.es2020,
+      },
+    },
+    plugins: {
+      "react-refresh": reactRefresh,
+    },
+    rules: {
+      "react-refresh/only-export-components": ["warn", { allowConstantExport: true }],
+    },
+  },
+];

apps/storybook/package.json

@@ -4,7 +4,7 @@
   "version": "0.0.0",
   "type": "module",
   "scripts": {
-    "lint": "eslint . --config .eslintrc.cjs --ext .ts,.tsx --report-unused-disable-directives --max-warnings 0",
+    "lint": "eslint . --report-unused-disable-directives --max-warnings 0",
     "typecheck": "tsc --noEmit",
     "preview": "vite preview",
     "storybook": "storybook dev -p 6006",
@@ -13,19 +13,21 @@
   },
   "devDependencies": {
     "@chromatic-com/storybook": "5.0.2",
+    "@eslint/js": "9.39.5",
     "@storybook/addon-a11y": "10.3.6",
     "@storybook/addon-docs": "10.3.6",
     "@storybook/addon-links": "10.3.6",
     "@storybook/addon-onboarding": "10.3.6",
     "@storybook/react-vite": "10.3.6",
     "@tailwindcss/vite": "4.2.4",
-    "@typescript-eslint/eslint-plugin": "8.57.2",
-    "@typescript-eslint/parser": "8.57.2",
     "@vitejs/plugin-react": "5.1.4",
+    "eslint-plugin-react-hooks": "7.1.1",
     "eslint-plugin-react-refresh": "0.4.26",
     "eslint-plugin-storybook": "10.3.6",
+    "globals": "16.5.0",
     "storybook": "10.3.6",
     "typescript": "5.9.3",
+    "typescript-eslint": "8.63.0",
     "vite": "7.3.5"
   }
 }

apps/web/app/(app)/workspaces/[workspaceId]/components/MainNavigation.tsx

@@ -246,6 +246,7 @@
     const ts = new Date(trialEnd).getTime();
     if (!Number.isFinite(ts)) return null;
     const msPerDay = 86_400_000;
+    // eslint-disable-next-line react-hooks/purity -- migration ENG-1677
     return Math.ceil((ts - Date.now()) / msPerDay);
   }, [
     isFormbricksCloud,
@@ -337,7 +338,7 @@
         }
       });
     },
     [router, organization.id, workspace.id]
   );
 
   const switcherTriggerClasses = cn(

apps/web/app/(app)/workspaces/[workspaceId]/settings/account/notifications/components/NotificationSwitch.tsx

@@ -114,8 +114,7 @@
           break;
       }
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
   return (
     <Switch

apps/web/app/(app)/workspaces/[workspaceId]/settings/workspace/integrations/airtable/components/AddIntegrationModal.tsx

@@ -216,8 +216,7 @@
     } else {
       reset();
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [isEditMode]);
 
   const survey = watch("survey");
   const includeVariables = watch("includeVariables");

apps/web/app/(app)/workspaces/[workspaceId]/settings/workspace/integrations/notion/components/AddIntegrationModal.tsx

@@ -110,8 +110,7 @@
         type: dbProperties[fieldKey].type,
       })) || []
     );
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [selectedDatabase?.id]);
 
   const elementItems = useMemo(() => {
     const mappedElements = selectedSurvey
@@ -156,8 +155,7 @@
     }));
 
     return [...mappedElements, ...variables, ...hiddenFields, ...Metadata, ...createdAt, ...personAttributes];
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [selectedSurvey?.id, contactAttributeKeys]);
 
   useEffect(() => {
     if (selectedIntegration) {

apps/web/app/(app)/workspaces/[workspaceId]/settings/workspace/integrations/notion/components/MappingRow.tsx

@@ -73,7 +73,6 @@ const MappingErrorMessage = ({
       default:
         return null;
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [error, col, elem, t]);
 
   if (!error) return null;

apps/web/app/(app)/workspaces/[workspaceId]/surveys/[surveyId]/(analysis)/responses/components/ResponsePage.tsx

@@ -51,8 +51,7 @@
   const filters = useMemo(
     () => getFormattedFilters(survey, selectedFilter, dateRange),
 
-    // eslint-disable-next-line react-hooks/exhaustive-deps
     [selectedFilter, dateRange]
   );
 
   const searchParams = useSearchParams();
@@ -108,7 +107,7 @@
     } finally {
       setIsFetchingFirstPage(false);
     }
   }, [filters, responsesPerPage, surveyId]);
 
   useEffect(() => {
     return registerAnalysisRefreshHandler(refetchResponses);
@@ -163,8 +162,7 @@
     };
     fetchFilteredResponses();
     // page is intentionally omitted to avoid refetching after the initial page setup.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [filters, responsesPerPage, selectedFilter, dateRange, surveyId]);
 
   return (
     <>

apps/web/app/(app)/workspaces/[workspaceId]/surveys/[surveyId]/components/CustomFilter.tsx

@@ -158,8 +158,7 @@
   const filters = useMemo(
     () => getFormattedFilters(survey, selectedFilter, dateRange),
 
-    // eslint-disable-next-line react-hooks/exhaustive-deps
     [selectedFilter, dateRange]
   );
 
   const datePickerRef = useRef<HTMLDivElement>(null);

apps/web/app/(app)/workspaces/[workspaceId]/surveys/[surveyId]/components/ElementFilterComboBox.tsx

@@ -252,7 +252,6 @@ export const ElementFilterComboBox = ({
         />
       ) : (
         <Command ref={commandRef} className="relative h-fit w-full min-w-0 overflow-visible bg-transparent">
-          {/* eslint-disable-next-line jsx-a11y/prefer-tag-over-role */}
           <div
             role="button"
             tabIndex={isComboBoxDisabled ? -1 : 0}

apps/web/app/(app)/workspaces/[workspaceId]/surveys/[surveyId]/components/ElementsComboBox.tsx

@@ -200,7 +200,6 @@ export const ElementsComboBox = ({ options, selected, onChangeValue }: ElementCo
     <Command
       ref={commandRef}
       className="relative h-fit w-full overflow-visible rounded-md border border-slate-300 bg-white hover:border-slate-400">
-      {/* eslint-disable-next-line jsx-a11y/prefer-tag-over-role */}
       <div
         role="button"
         tabIndex={0}

apps/web/app/(app)/workspaces/[workspaceId]/surveys/[surveyId]/components/ResponseFilter.tsx

@@ -91,6 +91,7 @@ export const ResponseFilter = ({ survey }: ResponseFilterProps) => {
   // session cookie → Next.js route refresh → new `survey` reference; depending on it here would re-fire
   // getSurveyFilterDataAction on every refresh while the popover is open, i.e. an infinite loop.
   const surveyRef = useRef(survey);
+  // eslint-disable-next-line react-hooks/refs -- intentional latest-value ref (see above); the effect reads surveyRef.current, never renders from it
   surveyRef.current = survey;
 
   useEffect(() => {
@@ -160,7 +161,6 @@ export const ResponseFilter = ({ survey }: ResponseFilterProps) => {
     if (!isOpen) {
       clearItem();
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [isOpen]);
 
   const handleAddNewFilter = () => {

apps/web/app/api/v1/auth.test.ts

@@ -292,7 +292,9 @@ describe("handleErrorResponse", () => {
   });
 
   test("returns 409 conflict for UniqueConstraintError", async () => {
-    const { response } = handleErrorResponse(new UniqueConstraintError("Action with name foo already exists"));
+    const { response } = handleErrorResponse(
+      new UniqueConstraintError("Action with name foo already exists")
+    );
     expect(response.status).toBe(409);
     const body = await response.json();
     expect(body.code).toBe("conflict");

apps/web/app/api/v3/feedbackRecords/[[...path]]/route.ts

@@ -0,0 +1,14 @@
+import { NextRequest } from "next/server";
+import { proxyFeedbackRecordsRequest } from "@/modules/hub/feedback-records-proxy";
+
+const handler = async (request: NextRequest): Promise<Response> => {
+  return await proxyFeedbackRecordsRequest(request);
+};
+
+export const GET = handler;
+export const POST = handler;
+export const PUT = handler;
+export const PATCH = handler;
+export const DELETE = handler;
+export const HEAD = handler;
+export const OPTIONS = handler;

apps/web/app/sentry/SentryProvider.tsx

@@ -63,7 +63,6 @@ export const SentryProvider = ({
       });
     }
     // We only want to run this once
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
   return <>{children}</>;

apps/web/app/v1/feedback-records/[[...path]]/route.ts

@@ -0,0 +1,14 @@
+import { NextRequest } from "next/server";
+import { proxyFeedbackRecordsRequest } from "@/modules/hub/feedback-records-proxy";
+
+const handler = async (request: NextRequest): Promise<Response> => {
+  return await proxyFeedbackRecordsRequest(request);
+};
+
+export const GET = handler;
+export const POST = handler;
+export const PUT = handler;
+export const PATCH = handler;
+export const DELETE = handler;
+export const HEAD = handler;
+export const OPTIONS = handler;

apps/web/eslint.config.mjs

@@ -0,0 +1,33 @@
+import next from "@formbricks/eslint-config/next";
+
+const config = [
+  // carried over from the legacy .eslintignore / ignorePatterns
+  {
+    ignores: [
+      ".next/**",
+      "public/**",
+      "playwright/**",
+      "vendor/**",
+      "**/package.json",
+      "**/tsconfig.json",
+    ],
+  },
+  ...next,
+  {
+    rules: {
+      // runtime-only env read in integration/gen-boolean-client.mjs; hashing it in turbo.json is tracked separately (ENG-1682)
+      "turbo/no-undeclared-env-vars": ["error", { allowList: ["PATH"] }],
+      // TODO(ENG-1677): enable incrementally — pre-existing violations from the React Compiler-era react-hooks rules
+      "react-hooks/set-state-in-effect": "off",
+      "react-hooks/incompatible-library": "off",
+      "react-hooks/error-boundaries": "off",
+      "react-hooks/immutability": "off",
+      "react-hooks/preserve-manual-memoization": "off",
+      // Kept as a warning (not off): exhaustive-deps is the main guard against stale closures, and the
+      // web lint script has no `--max-warnings 0`, so it surfaces violations without blocking (ENG-1677).
+      "react-hooks/exhaustive-deps": "warn",
+    },
+  },
+];
+
+export default config;

apps/web/lib/useDocumentVisibility.ts

@@ -14,6 +14,5 @@ export const useDocumentVisibility = (onVisible: () => void) => {
     return () => {
       document.removeEventListener("visibilitychange", listener);
     };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 };

apps/web/lib/utils/action-client/index.ts

@@ -25,7 +25,6 @@ export const actionClient = createSafeActionClient({
       },
     });
 
-    // eslint-disable-next-line no-console -- This error needs to be logged for debugging server-side errors
     logger.withContext({ eventId }).error(e, "SERVER ERROR");
     return DEFAULT_SERVER_ERROR_MESSAGE;
   },

apps/web/modules/analysis/components/RatingSmiley/index.tsx

@@ -67,6 +67,7 @@ const getSmiley = ({
   const containerSize = size * 2;
 
   const icon = (
+    // eslint-disable-next-line @next/next/no-img-element -- migration ENG-1677
     <img
       data-testid={faceIcons[iconIdx]}
       src={

apps/web/modules/auth/lib/better-auth-observability.integration.test.ts

@@ -2,9 +2,7 @@ import { beforeEach, describe, expect, test, vi } from "vitest";
 import { prisma } from "@formbricks/database";
 import { resetDb } from "@/integration/reset-db";
 import { hashSecret } from "@/lib/crypto";
-// eslint-disable-next-line import/first
 import { auth } from "@/modules/auth/lib/auth";
-// eslint-disable-next-line import/first -- must import after the vi.mock above is registered
 import * as auditHandler from "@/modules/ee/audit-logs/lib/handler";
 
 // Capture audit emission without running the real background audit logging (DB writes via setImmediate).

apps/web/modules/core/rate-limit/rate-limit-load.test.ts

@@ -10,7 +10,6 @@ let isRedisAvailable = false;
 // Test Redis availability
 async function checkRedisAvailability() {
   try {
-    // eslint-disable-next-line @typescript-eslint/await-thenable
     const redis = await cache.getRedisClient();
     if (redis === null) {
       console.log("Redis client is null - Redis not available");
@@ -147,7 +146,7 @@ describe("Rate Limiter Load Tests - Race Conditions", () => {
     console.log("🟢 Rate Limiter Load Tests: Redis available - tests will run");
 
     // Clear any existing test keys
-    // eslint-disable-next-line @typescript-eslint/await-thenable
+
     const redis = await cache.getRedisClient();
     if (redis) {
       const testKeys = await redis.keys("fb:rate_limit:test:*");
@@ -166,7 +165,6 @@ describe("Rate Limiter Load Tests - Race Conditions", () => {
       return;
     }
 
-    // eslint-disable-next-line @typescript-eslint/await-thenable
     const redis = await cache.getRedisClient();
     if (redis) {
       const testKeys = await redis.keys("fb:rate_limit:test:*");
@@ -329,7 +327,7 @@ describe("Rate Limiter Load Tests - Race Conditions", () => {
     const identifier = "stress-test";
 
     // Clear any existing keys first to ensure clean state
-    // eslint-disable-next-line @typescript-eslint/await-thenable
+
     const redis = await cache.getRedisClient();
     if (redis) {
       const existingKeys = await redis.keys(`fb:rate_limit:${config.namespace}:*`);
@@ -458,7 +456,7 @@ describe("Rate Limiter Load Tests - Race Conditions", () => {
     const identifier = "ttl-test-user";
 
     // Clear any existing keys first
-    // eslint-disable-next-line @typescript-eslint/await-thenable
+
     const redis = await cache.getRedisClient();
     if (redis) {
       const existingKeys = await redis.keys(`fb:rate_limit:${config.namespace}:*`);

apps/web/modules/ee/analysis/charts/components/chart-row.tsx

@@ -37,7 +37,6 @@ export function ChartRow({ chart, workspaceId, isReadOnly, directories }: Readon
   return (
     <>
       {/* Cannot use native <button>; row contains dropdown trigger (nested interactive invalid) */}
-      {/* eslint-disable-next-line jsx-a11y/prefer-tag-over-role, jsx-a11y/no-static-element-interactions */}
       <div
         role={isReadOnly ? undefined : "button"}
         tabIndex={isReadOnly ? undefined : 0}

apps/web/modules/ee/analysis/dashboards/components/add-existing-charts-dialog.tsx

@@ -60,6 +60,7 @@ export function AddExistingChartsDialog({
   const [isAdding, setIsAdding] = useState(false);
 
   const existingChartIdsRef = useRef(existingChartIds);
+  // eslint-disable-next-line react-hooks/refs -- migration ENG-1677
   existingChartIdsRef.current = existingChartIds;
 
   const loadCharts = useCallback(async () => {