ESLint 9.21.0 represents a minor update over version 9.20.1, focusing on refinements and dependency upgrades. Developers will find the core functionality remains consistent, ensuring a smooth transition. The primary difference lies in the updated dependencies, notably within the @eslint scope. Key updates include @eslint/js moving from 9.20.0 to 9.21.0, @eslint/core jumping from 0.11.0 to ^0.12.0, @eslint/eslintrc being updated from 3.2.0 to ^3.3.0, @eslint/plugin-kit from 0.2.5 to ^0.2.7, and @eslint/config-array from 0.19.0 to ^0.19.2. Furthermore, @humanwhocodes/retry was upgraded from 0.4.1 to ^0.4.2. These dependency bumps likely include bug fixes, performance improvements, and potentially, new features within those specific modules. The newer version also shows a small uptick in fileCount (426 vs 425) and unpackedSize (3465019 vs 3388029) maybe related to that. For developers the most relevant update is that the new version includes the date of release 9 days after the previous one. While ESLint aims for backward compatibility, it's always prudent to review the changelogs of the updated dependencies to understand any potential impact on existing configurations and linting rules. The update ensures developers can leverage the latest improvements and bug fixes within ESLint's core components.
All the vulnerabilities related to the version 9.21.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.