🚨 [security] Update eslint 8.57.1 → 9.39.2 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ @​eslint/plugin-kit (indirect, 0.3.1 → 0.4.1) · Repo · Changelog

Security Advisories 🚨

🚨 @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser

Summary

The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.

Details

The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].

PoC

const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = <span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s">"A"</span><span class="pl-kos">.</span><span class="pl-en">repeat</span><span class="pl-kos">(</span><span class="pl-c1">1000000</span><span class="pl-kos">)</span><span class="pl-kos">}</span></span>?: 1 B: 2;
console.log("start")

var parser = new ConfigCommentParser();

console.log(parser.parseJSONLikeConfig(str));

console.log("end")
// run npm i @eslint/plugin-kit@0.3.3 and node attack.js

// then the program will stuck forever with high CPU usage

Impact

This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.

Release Notes

0.4.1 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.16.0 to ^0.17.0

0.4.0 (from changelog)

Features

• add support for getLocFromIndex and getIndexFromLoc (#212) (a3588d8)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.15.2 to ^0.16.0

0.3.5 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.15.1 to ^0.15.2

0.3.4 (from changelog)

Bug Fixes

• potential quadratic runtime in regular expression (#240) (b283f64)

0.3.3 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.15.0 to ^0.15.1

0.3.2 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.14.0 to ^0.15.0

Does any of this look wrong? Please let us know.

↗️ acorn (indirect, 8.14.1 → 8.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 16 commits:

• Mark version 8.15.0
• Make linter happy
• Fix a crash when running the CLI tool on code with a bigint
• Fix the format of bigint property on bigint literal
• Show logo in readme.md
• Add support for using and await using
• Bump test262
• Make sure the loose parser skips number literals with invalid separators
• Remove outdated comment
• Remove trailing whitespace, semicolon
• Define a NodeTypes record that plugins can extend to add nodes to AnyNode
• Switch some types on walk.d.ts from Node to AnyNode
• Add a package lock file
• fix(ci): run in correct branch
• setup(ci): consolidate
• Mark acorn-loose 8.5.0

↗️ eslint-visitor-keys (indirect, 4.2.0 → 4.2.1) · Repo · Changelog

🆕 js-yaml (added, 4.1.1)

🆕 brace-expansion (added, 1.1.12)

🆕 @​eslint/eslintrc (added, 3.3.3)

🆕 espree (added, 10.4.0)

🆕 @​eslint/js (added, 9.39.2)

🆕 eslint (added, 9.39.2)

🆕 eslint-scope (added, 8.4.0)

🗑️ @​esbuild/aix-ppc64 (removed)

🗑️ @​esbuild/aix-ppc64 (removed)

🗑️ @​esbuild/android-arm (removed)

🗑️ @​esbuild/android-arm (removed)

🗑️ @​esbuild/android-arm64 (removed)

🗑️ @​esbuild/android-arm64 (removed)

🗑️ @​esbuild/android-x64 (removed)

🗑️ @​esbuild/android-x64 (removed)

🗑️ @​esbuild/darwin-arm64 (removed)

🗑️ @​esbuild/darwin-arm64 (removed)

🗑️ @​esbuild/darwin-x64 (removed)

🗑️ @​esbuild/darwin-x64 (removed)

🗑️ @​esbuild/freebsd-arm64 (removed)

🗑️ @​esbuild/freebsd-arm64 (removed)

🗑️ @​esbuild/freebsd-x64 (removed)

🗑️ @​esbuild/freebsd-x64 (removed)

🗑️ @​esbuild/linux-arm (removed)

🗑️ @​esbuild/linux-arm (removed)

🗑️ @​esbuild/linux-arm64 (removed)

🗑️ @​esbuild/linux-arm64 (removed)

🗑️ @​esbuild/linux-ia32 (removed)

🗑️ @​esbuild/linux-ia32 (removed)

🗑️ @​esbuild/linux-loong64 (removed)

🗑️ @​esbuild/linux-loong64 (removed)

🗑️ @​esbuild/linux-mips64el (removed)

🗑️ @​esbuild/linux-mips64el (removed)

🗑️ @​esbuild/linux-ppc64 (removed)

🗑️ @​esbuild/linux-ppc64 (removed)

🗑️ @​esbuild/linux-riscv64 (removed)

🗑️ @​esbuild/linux-riscv64 (removed)

🗑️ @​esbuild/linux-s390x (removed)

🗑️ @​esbuild/linux-s390x (removed)

🗑️ @​esbuild/linux-x64 (removed)

🗑️ @​esbuild/linux-x64 (removed)

🗑️ @​esbuild/netbsd-x64 (removed)

🗑️ @​esbuild/netbsd-x64 (removed)

🗑️ @​esbuild/openbsd-x64 (removed)

🗑️ @​esbuild/openbsd-x64 (removed)

🗑️ @​esbuild/sunos-x64 (removed)

🗑️ @​esbuild/sunos-x64 (removed)

🗑️ @​esbuild/win32-arm64 (removed)

🗑️ @​esbuild/win32-arm64 (removed)

🗑️ @​esbuild/win32-ia32 (removed)

🗑️ @​esbuild/win32-ia32 (removed)

🗑️ @​esbuild/win32-x64 (removed)

🗑️ @​esbuild/win32-x64 (removed)

🗑️ esbuild (removed)

🗑️ esbuild (removed)

🗑️ @​bcoe/v8-coverage (removed)

🗑️ @​bufbuild/protobuf (removed)

🗑️ @​colors/colors (removed)

🗑️ @​dabh/diagnostics (removed)

🗑️ @​elastic/ecs-helpers (removed)

🗑️ @​elastic/ecs-pino-format (removed)

🗑️ @​elastic/elasticsearch (removed)

🗑️ @​elastic/transport (removed)

🗑️ @​esbuild/netbsd-arm64 (removed)

🗑️ @​esbuild/openbsd-arm64 (removed)

🗑️ @​esbuild/openharmony-arm64 (removed)

🗑️ @​grpc/grpc-js (removed)

🗑️ @​grpc/proto-loader (removed)

🗑️ @​humanwhocodes/config-array (removed)

🗑️ @​humanwhocodes/object-schema (removed)

🗑️ @​istanbuljs/schema (removed)

🗑️ @​js-sdsl/ordered-map (removed)

🗑️ @​localazy/languages (removed)

🗑️ @​opentelemetry/api (removed)

🗑️ @​opentelemetry/core (removed)

🗑️ @​opentelemetry/resources (removed)

🗑️ @​opentelemetry/sdk-metrics (removed)

🗑️ @​opentelemetry/semantic-conventions (removed)

🗑️ @​protobufjs/aspromise (removed)

🗑️ @​protobufjs/base64 (removed)

🗑️ @​protobufjs/codegen (removed)

🗑️ @​protobufjs/eventemitter (removed)

🗑️ @​protobufjs/fetch (removed)

🗑️ @​protobufjs/float (removed)

🗑️ @​protobufjs/inquire (removed)

🗑️ @​protobufjs/path (removed)

🗑️ @​protobufjs/pool (removed)

🗑️ @​protobufjs/utf8 (removed)

🗑️ @​restorecommerce/dataset-demoshop-catalog-transformer (removed)

🗑️ @​restorecommerce/dataset-system-units-transformer (removed)

🗑️ @​restorecommerce/dataset-system-world-transformer (removed)

🗑️ @​restorecommerce/dev (removed)

🗑️ @​eslint/compat (removed)

🗑️ @​typescript-eslint/scope-manager (removed)

🗑️ @​typescript-eslint/scope-manager (removed)

🗑️ @​typescript-eslint/scope-manager (removed)

🗑️ @​typescript-eslint/scope-manager (removed)

🗑️ @​typescript-eslint/types (removed)

🗑️ @​typescript-eslint/types (removed)

🗑️ @​typescript-eslint/types (removed)

🗑️ @​typescript-eslint/types (removed)

🗑️ @​typescript-eslint/typescript-estree (removed)

🗑️ @​typescript-eslint/typescript-estree (removed)

🗑️ @​typescript-eslint/typescript-estree (removed)

🗑️ @​typescript-eslint/typescript-estree (removed)

🗑️ @​typescript-eslint/utils (removed)

🗑️ @​typescript-eslint/utils (removed)

🗑️ @​typescript-eslint/utils (removed)

🗑️ @​typescript-eslint/utils (removed)

🗑️ @​typescript-eslint/visitor-keys (removed)

🗑️ @​typescript-eslint/visitor-keys (removed)

🗑️ @​typescript-eslint/visitor-keys (removed)

🗑️ @​typescript-eslint/visitor-keys (removed)

🗑️ eslint-plugin-prefer-arrow-functions (removed)

🗑️ ts-api-utils (removed)

🗑️ ts-api-utils (removed)

🗑️ @​restorecommerce/grpc-client (removed)

🗑️ @​restorecommerce/logger (removed)

🗑️ @​restorecommerce/rc-grpc-clients (removed)

🗑️ @​rollup/rollup-android-arm-eabi (removed)

🗑️ @​rollup/rollup-android-arm64 (removed)

🗑️ @​rollup/rollup-darwin-arm64 (removed)

🗑️ @​rollup/rollup-darwin-x64 (removed)

🗑️ @​rollup/rollup-freebsd-arm64 (removed)

🗑️ @​rollup/rollup-freebsd-x64 (removed)

🗑️ @​rollup/rollup-linux-arm-gnueabihf (removed)

🗑️ @​rollup/rollup-linux-arm-musleabihf (removed)

🗑️ @​rollup/rollup-linux-arm64-gnu (removed)

🗑️ @​rollup/rollup-linux-arm64-musl (removed)

🗑️ @​rollup/rollup-linux-loongarch64-gnu (removed)

🗑️ @​rollup/rollup-linux-powerpc64le-gnu (removed)

🗑️ @​rollup/rollup-linux-riscv64-gnu (removed)

🗑️ @​rollup/rollup-linux-riscv64-musl (removed)

🗑️ @​rollup/rollup-linux-s390x-gnu (removed)

🗑️ @​rollup/rollup-linux-x64-gnu (removed)

🗑️ @​rollup/rollup-linux-x64-musl (removed)

🗑️ @​rollup/rollup-win32-arm64-msvc (removed)

🗑️ @​rollup/rollup-win32-ia32-msvc (removed)

🗑️ @​rollup/rollup-win32-x64-msvc (removed)

🗑️ @​stylistic/eslint-plugin (removed)

🗑️ @​swc/helpers (removed)

🗑️ @​types/argparse (removed)

🗑️ @​types/command-line-args (removed)

🗑️ @​types/command-line-usage (removed)

🗑️ @​types/google-protobuf (removed)

🗑️ @​types/js-yaml (removed)

🗑️ @​types/triple-beam (removed)

🗑️ @​typescript-eslint/eslint-plugin (removed)

🗑️ @​typescript-eslint/eslint-plugin (removed)

🗑️ @​typescript-eslint/parser (removed)

🗑️ @​typescript-eslint/parser (removed)

🗑️ @​typescript-eslint/type-utils (removed)

🗑️ @​typescript-eslint/type-utils (removed)

🗑️ @​ungap/structured-clone (removed)

🗑️ @​vitest/coverage-v8 (removed)

🗑️ @​vitest/expect (removed)

🗑️ @​vitest/mocker (removed)

🗑️ @​vitest/pretty-format (removed)

🗑️ @​vitest/runner (removed)

🗑️ @​vitest/snapshot (removed)

🗑️ @​vitest/spy (removed)

🗑️ @​vitest/utils (removed)

🗑️ @​vvo/tzdb (removed)

🗑️ abort-controller-x (removed)

🗑️ acorn-import-assertions (removed)

🗑️ after-all-results (removed)

🗑️ agentkeepalive (removed)

🗑️ apache-arrow (removed)

🗑️ array-back (removed)

🗑️ asap (removed)

🗑️ assertion-error (removed)

🗑️ async-cache (removed)

🗑️ async-hook-jl (removed)

🗑️ async-value (removed)

🗑️ async-value-promise (removed)

🗑️ atomic-sleep (removed)

🗑️ basic-auth (removed)

🗑️ binary-search (removed)

🗑️ breadth-filter (removed)

🗑️ builtin-modules (removed)

🗑️ cac (removed)

🗑️ chai (removed)

🗑️ chalk-template (removed)

🗑️ check-error (removed)

🗑️ cjs-module-lexer (removed)

🗑️ clean-regexp (removed)

🗑️ cls-hooked (removed)

🗑️ cls-rtracer (removed)

🗑️ color (removed)

🗑️ color-string (removed)

🗑️ colorspace (removed)

🗑️ command-line-args (removed)

🗑️ command-line-usage (removed)

🗑️ console-log-level (removed)

🗑️ cookie (removed)

🗑️ core-js-compat (removed)

🗑️ csv-parser (removed)

🗑️ currency-list (removed)

🗑️ dayjs (removed)

🗑️ deep-eql (removed)

🗑️ elastic-apm-node (removed)

🗑️ emitter-listener (removed)

🗑️ enabled (removed)

🗑️ error-callsites (removed)

🗑️ error-stack-parser (removed)

🗑️ es-module-lexer (removed)

🗑️ eslint-plugin-file-extension-in-import-ts (removed)

🗑️ eslint-plugin-unicorn (removed)

🗑️ estree-walker (removed)

🗑️ expect-type (removed)

🗑️ fast-redact (removed)

🗑️ fast-safe-stringify (removed)

🗑️ fast-stream-to-buffer (removed)

🗑️ fecha (removed)

🗑️ find-replace (removed)

🗑️ flatbuffers (removed)

🗑️ flatstr (removed)

🗑️ fn.name (removed)

🗑️ forwarded-parse (removed)

🗑️ fsevents (removed)

🗑️ google-protobuf (removed)

🗑️ graphemer (removed)

🗑️ hpagent (removed)

🗑️ html-escaper (removed)

🗑️ http-headers (removed)

🗑️ humanize-ms (removed)

🗑️ import-in-the-middle (removed)

🗑️ is-builtin-module (removed)

🗑️ is-finite (removed)

🗑️ is-integer (removed)

🗑️ is-native (removed)

🗑️ is-nil (removed)

🗑️ is-path-inside (removed)

🗑️ istanbul-lib-coverage (removed)

🗑️ istanbul-lib-report (removed)

🗑️ istanbul-lib-source-maps (removed)

🗑️ istanbul-reports (removed)

🗑️ json-bignum (removed)

🗑️ kuler (removed)

🗑️ lodash.camelcase (removed)

🗑️ lodash.defaults (removed)

🗑️ lodash.omit (removed)

🗑️ lodash.sortby (removed)

🗑️ logform (removed)

🗑️ long (removed)

🗑️ loupe (removed)

🗑️ magic-string (removed)

🗑️ magicast (removed)

🗑️ mapcap (removed)

🗑️ measured-core (removed)

🗑️ measured-reporting (removed)

🗑️ module-details-from-path (removed)

🗑️ monitor-event-loop-delay (removed)

🗑️ nanoid (removed)

🗑️ next-line (removed)

🗑️ nice-grpc (removed)

🗑️ nice-grpc-client-middleware-deadline (removed)

🗑️ nice-grpc-client-middleware-retry (removed)

🗑️ nice-grpc-common (removed)

🗑️ node-xlsx (removed)

🗑️ object-filter-sequence (removed)

🗑️ object-hash (removed)

🗑️ object-identity-map (removed)

🗑️ one-time (removed)

🗑️ optional-js (removed)

🗑️ original-url (removed)

🗑️ pathe (removed)

🗑️ pathval (removed)

🗑️ pino (removed)

🗑️ pino-std-serializers (removed)

🗑️ pluralize (removed)

🗑️ postcss (removed)

🗑️ process-warning (removed)

🗑️ promise (removed)

🗑️ protobufjs (removed)

🗑️ pseudomap (removed)

🗑️ quick-format-unescaped (removed)

🗑️ regexp-tree (removed)

🗑️ regjsparser (removed)

🗑️ relative-microtime (removed)

🗑️ require-in-the-middle (removed)

🗑️ rollup (removed)

🗑️ safe-stable-stringify (removed)

🗑️ secure-json-parse (removed)

🗑️ shallow-clone-shim (removed)

🗑️ shimmer (removed)

🗑️ siginfo (removed)

🗑️ simple-swizzle (removed)

🗑️ sonic-boom (removed)

🗑️ source-map-js (removed)

🗑️ source-map-support (removed)

🗑️ sql-summary (removed)

🗑️ stack-chain (removed)

🗑️ stack-trace (removed)

🗑️ stackback (removed)

🗑️ stackframe (removed)

🗑️ std-env (removed)

🗑️ stream-chopper (removed)

🗑️ table-layout (removed)

🗑️ test-exclude (removed)

🗑️ text-hex (removed)

🗑️ tinybench (removed)

🗑️ tinyexec (removed)

🗑️ tinypool (removed)

🗑️ tinyrainbow (removed)

🗑️ tinyspy (removed)

🗑️ to-source-code (removed)

🗑️ triple-beam (removed)

🗑️ ts-error (removed)

🗑️ ts-proto-descriptors (removed)

🗑️ typescript-eslint (removed)

🗑️ typical (removed)

🗑️ undici (removed)

🗑️ unicode-byte-truncate (removed)

🗑️ unicode-substring (removed)

🗑️ vite (removed)

🗑️ vite-node (removed)

🗑️ vitest (removed)

🗑️ why-is-node-running (removed)

🗑️ winston (removed)

🗑️ winston-elasticsearch (removed)

🗑️ winston-transport (removed)

🗑️ wordwrapjs (removed)

🗑️ world-countries (removed)

🗑️ xlsx (removed)

🗑️ @​eslint/eslintrc (removed)

🗑️ @​eslint/eslintrc (removed)

🗑️ espree (removed)

🗑️ espree (removed)

🗑️ globals (removed)

🗑️ globals (removed)

🗑️ type-fest (removed)

🗑️ @​eslint/js (removed)

🗑️ @​eslint/js (removed)

🗑️ rimraf (removed)

🗑️ uuid (removed)

🗑️ uuid (removed)

🗑️ lru-cache (removed)

🗑️ eslint (removed)

🗑️ eslint (removed)

🗑️ eslint-scope (removed)

🗑️ eslint-scope (removed)

🗑️ file-entry-cache (removed)

🗑️ flat-cache (removed)

🗑️ @​types/node (removed)

🗑️ undici-types (removed)

🗑️ yallist (removed)

🗑️ through2 (removed)

🗑️ source-map (removed)

🗑️ tr46 (removed)

🗑️ webidl-conversions (removed)

🗑️ whatwg-url (removed)

🗑️ is-arrayish (removed)

🗑️ jsesc (removed)

🗑️ picomatch (removed)

🗑️ retry (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)