ESLint has released version 9.20.0, a minor update from the previous stable version 9.19.0, bringing incremental improvements to this popular JavaScript linting tool. Key enhancements can be observed primarily within the dependency updates. The core ESLint modules have seen version bumps: @eslint/js moves from 9.19.0 to 9.20.0, and @eslint/core advances from 0.10.0 to 0.11.0. These core updates likely contain bug fixes, performance improvements, and potentially new linting rules or features that enhance code quality and maintainability. Developers should explore the changelogs for these specific packages to understand the precise changes.
In the devDependencies, @eslint/json moves from version 0.9.0 to 0.10.0. This could indicate updates and improvements to the JSON schema validation capabilities within ESLint's configuration. Small bumps to the eslint-related plugins and configurations mean there are most probably minor bug fixes or improvements.
While the core dependencies see updates, many devDependencies like @wdio/* testing framework components and metapscrapers are staying consistent, implying continued stability in the testing and documentation processes. The tarball size has seen a slight increase demonstrating possible new features and functionalities. The release dates shows a regular update cycle, approximately 2 weeks between each release. Developers should review detailed release notes for both ESLint 9.20.0 and its updated dependencies to fully leverage the benefits of this latest iteration.
All the vulnerabilities related to the version 9.20.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.