Version Details and Security Vulnerabilities

Version 3.3.1 of @eslint/eslintrc, released on March 21, 2025, introduces a minor but potentially impactful update compared to version 3.3.0, which was released a month prior on February 21, 2025. Both versions maintain the core functionality of handling the legacy ESLintRC config file format, crucial for projects still relying on older configuration styles within the ESLint ecosystem.

The key difference between versions lies in the dependencies. Version 3.3.1 lists import-fresh version ^3.2.1 and eslint-config-eslint version ^11.0.0 as a direct dependency, while version 3.3.0 declared the first one as a dependency and the latter as a development dependency. This seemingly small change may have implications for how eslint-config-eslint is bundled and accessed within projects using @eslint/eslintrc. The unpacked size has increased slightly in the newer version, suggesting adjustments in the bundled code influenced by the changed dependencies.

Both versions share common dependencies like ajv, debug, espree, globals, ignore, js-yaml, minimatch, and strip-json-comments, ensuring continued compatibility and feature parity for parsing and interpreting ESLint configuration files. Developers using @eslint/eslintrc should evaluate whether the updated dependency declaration affects their existing build processes or runtime behavior, especially if explicit control over dependency resolution is desired. The versions share similar development dependencies related to testing, building, and linting, providing a stable toolchain for contributing to or extending the functionality of the module. Both versions are licensed under MIT license and are under Nicholas C. Zakas authorship.