ESLint has released version 9.23.0, building upon the foundation of the previous stable version 9.22.0. Both versions serve as AST-based pattern checkers for JavaScript, crucial for maintaining code quality and consistency. A key difference lies in the updated dependencies; version 9.23.0 incorporates @eslint/js": "9.23.0", reflecting internal updates to ESLint's core JavaScript rules. Additionally, @eslint/eslintrc is updated to version 3.3.1 and @eslint/config-helpers is updated to version 0.2.0. These updates often include bug fixes, performance enhancements, and potentially new or modified linting rules.
For developers, this means an upgrade to 9.23.0 could introduce subtle changes in linting behavior, requiring a review of existing configurations to ensure continued compatibility and desired outcomes. While the tool's core functionality remains consistent, developers should pay attention to the updated rule set, especially if they customized their ESLint configuration. Both versions share the same peer dependency on jiti, simplifying integration for users already leveraging that package. The bumped-up dependencies @eslint/js, @eslint/eslintrc and @eslint/config-helpers suggest enhancements in the underlying engine that processes and applies ESLint's rules. This makes the new version more attractive as it has improvements in performance and reliability.
All the vulnerabilities related to the version 9.23.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.