ESLint version 3.12.1 is a minor patch release following closely after version 3.12.0 in December 2016, both maintained under the MIT license and authored by Nicholas C. Zakas. While the core description remains consistent—an AST-based pattern checker for JavaScript—developers will be keen to understand subtle improvements or bug fixes introduced in 3.12.1. A comparison of the two versions reveals that the dependencies and devDependencies remain identical, suggesting no new features or major updates were incorporated. Both versions rely on a robust ecosystem of tools including glob for file matching, escope for ECMAScript scope analysis, and espree as the default JavaScript parser. Development tools like mocha for testing, chai for assertions, and babelify for transpilation are also consistent.
The key distinction lies in the releaseDate, which indicates a very quick turnaround. This often signals that version 3.12.1 addresses critical bugs or regressions introduced in 3.12.0. For those using ESLint 3.12.0, upgrading to 3.12.1 is highly recommended to benefit from any stability improvements. The unchanged dependencies and development dependencies suggest a focused effort to correct a specific issue rather than a broad overhaul. If developers encountered anomalies with 3.12.0, this quick update is the first place to look for a resolution. Be mindful to consult with the ESLint's official changelog or release notes for full transparency on the changes in order to understand the specific changes made.
All the vulnerabilities related to the version 3.12.1 of the package
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
