ESLint 3.5.0 represents a minor version update over its predecessor, ESLint 3.4.0, offering subtle but valuable refinements for JavaScript developers. Both versions share the core functionality of an AST-based pattern checker, crucial for maintaining code quality and consistency across projects. Examining the dependencies and devDependencies reveals that both versions largely leverage the same underlying ecosystem of libraries, including crucial packages like espree for parsing, escope for scope analysis, and lodash for utility functions. This indicates a stable core architecture. However, the updated release date on version 3.5.0 (September 9, 2016), compared to 3.4.0 (August 26, 2016), signals bug fixes, performance improvements, or minor feature additions implemented within that timeframe. Developers upgrading to 3.5.0 can expect a potentially more polished and reliable experience. While the absence of specific changelog details makes pinpointing exact modifications challenging, minor updates frequently address edge cases, enhance rule performance, and refine error messages, all of which contribute to a smoother development workflow. The shared dependency list suggests that the update is likely backwards-compatible, minimizing disruption during upgrades. Overall, ESLint 3.5.0 provides a low-risk opportunity to benefit from the incremental improvements and refinements made to this popular JavaScript linting tool. Regular updates like this are key to keeping ESLint running smoothly in your projects.
All the vulnerabilities related to the version 3.5.0 of the package
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
