🚨 [security] Update eslint 9.15.0 → 9.39.2 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (9.15.0 → 9.39.2) · Repo · Changelog

Security Advisories 🚨

🚨 eslint has a Stack Overflow when serializing objects with circular references

There is a Stack Overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a Stack Overflow.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​eslint/eslintrc (indirect, 3.2.0 → 3.3.3) · Repo · Changelog

Release Notes

3.3.3 (from changelog)

Bug Fixes

• release v3.3.3 because publishing v3.3.2 failed (#211) (8aa555a)

3.3.1

3.3.1 (2025-03-11)

Bug Fixes

• correct types field in package.json (#184) (2f4cf3f)

3.3.0

3.3.0 (2025-02-21)

Features

• Add types to package (#179) (cb546be)

Does any of this look wrong? Please let us know.

↗️ @​eslint/js (indirect, 9.15.0 → 9.39.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​eslint/plugin-kit (indirect, 0.2.3 → 0.4.1) · Repo · Changelog

Security Advisories 🚨

🚨 @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser

Summary

The ConfigCommentParser#parseJSONLikeConfig API is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in its only argument.

Details

The regular expression at packages/plugin-kit/src/config-comment-parser.js:158 is vulnerable to a quadratic runtime attack because the grouped expression is not anchored. This can be solved by prepending the regular expression with [^-a-zA-Z0-9/].

PoC

const { ConfigCommentParser } = require("@eslint/plugin-kit");
const str = <span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s">"A"</span><span class="pl-kos">.</span><span class="pl-en">repeat</span><span class="pl-kos">(</span><span class="pl-c1">1000000</span><span class="pl-kos">)</span><span class="pl-kos">}</span></span>?: 1 B: 2;
console.log("start")

var parser = new ConfigCommentParser();

console.log(parser.parseJSONLikeConfig(str));

console.log("end")
// run npm i @eslint/plugin-kit@0.3.3 and node attack.js

// then the program will stuck forever with high CPU usage

Impact

This is a Regular Expression Denial of Service attack which may lead to blocking execution and high CPU usage.

Release Notes

0.4.1 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.16.0 to ^0.17.0

0.4.0 (from changelog)

Features

• add support for getLocFromIndex and getIndexFromLoc (#212) (a3588d8)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.15.2 to ^0.16.0

0.3.5 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.15.1 to ^0.15.2

0.3.4 (from changelog)

Bug Fixes

• potential quadratic runtime in regular expression (#240) (b283f64)

0.3.3 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.15.0 to ^0.15.1

0.3.2 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.14.0 to ^0.15.0

0.3.1 (from changelog)

Bug Fixes

• Upgrade @eslint/core (#197) (a830283)

0.2.8 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.12.0 to ^0.13.0

0.2.7 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.11.0 to ^0.12.0

0.2.6 (from changelog)

Bug Fixes

• CommonJS types in all packages (#148) (c91866c)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.10.0 to ^0.11.0

0.2.5 (from changelog)

Bug Fixes

• make plugin-kit types usable in CommonJS (#143) (f77ba17)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @eslint/core bumped from ^0.9.1 to ^0.10.0

0.2.4 (from changelog)

Bug Fixes

• Update RuleVisitor type (#135) (156d601)

Dependencies

• The following workspace dependencies were updated
  • devDependencies
    • @eslint/core bumped from ^0.9.0 to ^0.9.1

Does any of this look wrong? Please let us know.

↗️ acorn (indirect, 8.14.0 → 8.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 26 commits:

• Mark version 8.15.0
• Make linter happy
• Fix a crash when running the CLI tool on code with a bigint
• Fix the format of bigint property on bigint literal
• Show logo in readme.md
• Add support for using and await using
• Bump test262
• Make sure the loose parser skips number literals with invalid separators
• Remove outdated comment
• Remove trailing whitespace, semicolon
• Define a NodeTypes record that plugins can extend to add nodes to AnyNode
• Switch some types on walk.d.ts from Node to AnyNode
• Add a package lock file
• fix(ci): run in correct branch
• setup(ci): consolidate
• Mark acorn-loose 8.5.0
• Mark version 8.14.1
• Make sure `ExportNamedDeclaration` nodes always have an `attributes` property
• Consistent field order in `Property` in tests
• Consistent field order in `Property`
• Include file name in `SyntaxError` message if present
• Remove empty @param declarations from acorn-walk type declarations
• Allow null in types of optional params to findNodeAt and findNodeAround
• Change approach to field init scope tracking
• Further refine handling of await in class fields
• Make sure await in class field initializers is checked properly

↗️ eslint-scope (indirect, 8.2.0 → 8.4.0) · Repo · Changelog

↗️ espree (indirect, 10.3.0 → 10.4.0) · Repo · Changelog

Release Notes

10.4.0 (from changelog)

Features

• Add support for ES2026 using and await using declarations (#658) (39e0865)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.2.0 to ^4.2.1

Does any of this look wrong? Please let us know.

↗️ js-yaml (indirect, 4.1.0 → 4.1.1) · Repo · Changelog

Security Advisories 🚨

🚨 js-yaml has prototype pollution in merge (<<)

Impact

In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted.

Patches

Problem is patched in js-yaml 4.1.1 and 3.14.2.

Workarounds

You can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).

References

https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html

Release Notes

4.1.1 (from changelog)

Security

• Fix prototype pollution issue in yaml merge (<<) operator.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

• 4.1.1 released
• dist rebuild
• lint fix
• fix prototype pollution in merge (<<)
• README.md: HTTP => HTTPS (#678)
• doc: 'empty' style option for !!null
• Fix demo link (#618)

🆕 @​eslint/config-helpers (added, 0.4.2)

🆕 brace-expansion (added, 1.1.12)

🆕 eslint-visitor-keys (added, 4.2.1)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[coveralls]

Pull Request Test Coverage Report for Build 21486455955

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 87.831%

---

Totals
Change from base Build 15924915913:	0.0%
Covered Lines:	405
Relevant Lines:	461

---

💛 - Coveralls