ESLint 9.24.0 introduces several updates compared to version 9.23.0, primarily focusing on dependency upgrades and refinements. Developers upgrading from the previous version will see a bump in @eslint/js from 9.23.0 to 9.24.0, aligning the core JavaScript language options and environments with the latest ECMAScript standards. In @eslint/config-array dependency has evolved from 0.19.2 to 0.20.0. Noticeable changes also appear in the @types/node devDependency with the version jumped from 20.11.5 to 22.13.14.
Furthermore, while remaining dependencies stay generally aligned, there is an increased file count (420 to 421) indicating slight modifications or additions within the package structure. The unpacked size also sees a growth, from 2896473 to 2913009. These changes suggest internal improvements or potentially the inclusion of new language features or rule enhancements.
For developers, this means staying current with the latest JavaScript and Typescript features and best practices, as ESLint adapts to evolving languages. By keeping up-to-date, developers can ensure their codebases adhere to modern coding standards, maintainability and clarity. The upgrades also contribute to long-term stability and security by addressing potential vulnerabilities and incompatibilities.
All the vulnerabilities related to the version 9.24.0 of the package
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.
The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].
const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = `${"A".repeat(1000000)}?: 1 B: 2`;
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseJSONLikeConfig(str));
console.log("end")
// run `npm i @eslint/plugin-kit@0.3.3` and `node attack.js`
// then the program will stuck forever with high CPU usage
This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.