[Snyk] Upgrade eslint from 6.8.0 to 9.16.0 #111
Conversation
Snyk has created this PR to upgrade eslint from 6.8.0 to 9.16.0. See this package in npm: eslint See this project in Snyk: https://app.snyk.io/org/nerds-github/project/5c08c7f3-e081-4b45-bb54-aed4a1afcddf?utm_source=github&utm_medium=referral&page=upgrade-pr
Reviewer's Guide by SourceryThis PR upgrades eslint from 6.8.0 to 9.16.0 in the package.json file located in deps/v8/tools/clusterfuzz/js_fuzzer. This upgrade fixes several high and critical severity vulnerabilities, including prototype pollution, inefficient regular expression complexity, incomplete list of disallowed inputs, uncontrolled resource consumption, regular expression denial of service, denial of service, authentication bypass, prototype poisoning, insecure randomness, and more. The upgrade also introduces new features such as an ignoreComputedKeys option in the sort-keys rule, support for import attributes and RegExp modifiers, hooks for RuleTester test cases, alternate config lookup, and modified cyclomatic complexity. Several bug fixes, documentation updates, and build-related improvements are included as well. State diagram of ESLint security improvementsstateDiagram-v2
[*] --> ESLint_6.8.0
ESLint_6.8.0 --> ESLint_9.16.0: Upgrade
state ESLint_6.8.0 {
Vulnerable --> PrototypePollution
Vulnerable --> RegExpDoS
Vulnerable --> AuthBypass
}
state ESLint_9.16.0 {
Fixed --> SecurityPatches
Fixed --> PerformanceImprovements
Fixed --> NewFeatures
}
ESLint_9.16.0 --> [*]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
We have skipped reviewing this pull request. Here's why:
- It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
- We don't review packaging changes - Let us know if you'd like us to change this.
Snyk has created this PR to upgrade eslint from 6.8.0 to 9.16.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 134 versions ahead of your current version.
The recommended version was released a month ago.
Issues fixed by the recommended upgrade:
SNYK-JS-MICROMATCH-6838728
SNYK-JS-AJV-584908
SNYK-JS-BABELTRAVERSE-5962462
SNYK-JS-BRACES-6838727
SNYK-JS-CROSSSPAWN-8303230
SNYK-JS-DECODEURICOMPONENT-3149970
SNYK-JS-HAWK-2808852
SNYK-JS-SEMVER-3247795
SNYK-JS-UNSETVALUE-2400660
SNYK-JS-GLOBPARENT-1016905
SNYK-JS-HAWK-6969142
SNYK-JS-QS-3153490
npm:cryptiles:20180710
SNYK-JS-PATHTOREGEXP-7925106
Release notes
Package name: eslint
Features
8f70eb1feat: AddignoreComputedKeysoption insort-keysrule (#19162) (Milos Djermanovic)Documentation
9eefc8fdocs: fix typos inuse-isnan(#19190) (루밀LuMir)0c8cea8docs: switch the order of words inno-unreachable(#19189) (루밀LuMir)0c19417docs: add missing backtick tono-async-promise-executor(#19188) (루밀LuMir)8df9276docs: add backtick in-0indescriptionofno-compare-neg-zero(#19186) (루밀LuMir)7e16e3fdocs: fixcaseSensitiveoption's title ofsort-keys(#19183) (Tanuj Kanti)0c6b842docs: fix typos inmigration-guide.md(#19180) (루밀LuMir)353266edocs: fix a typo indebug.md(#19179) (루밀LuMir)5ff318adocs: delete unnecessary horizontal rule(---) innodejs-api(#19175) (루밀LuMir)576bcc5docs: mark more rules as handled by TypeScript (#19164) (Tanuj Kanti)742d054docs: note thatno-restricted-syntaxcan be used with any language (#19148) (Milos Djermanovic)Chores
feb703bchore: upgrade to@ eslint/[email protected](#19195) (Francesco Trotta)df9bf95chore: package.json update for @ eslint/js release (Jenkins)f831893chore: add type forignoreComputedKeysoption ofsort-keys(#19184) (Tanuj Kanti)3afb8a1chore: update dependency @ eslint/json to ^0.8.0 (#19177) (Milos Djermanovic)1f77c53chore: addrepository.directoryproperty topackage.json(#19165) (루밀LuMir)d460594chore: update dependency @ arethetypeswrong/cli to ^0.17.0 (#19147) (renovate[bot])45cd4earefactor: update default options in rules (#19136) (Milos Djermanovic)Features
01557cefeat: Implement Language#normalizeLanguageOptions() (#19104) (Nicholas C. Zakas)2edc0e2feat: add meta.defaultOptions (#17656) (Josh Goldberg ✨)bdec50efeat: fixno-useless-computed-keyfalse negative with__proto__(#19123) (Milos Djermanovic)3087c9efeat: addmetaobject to@ eslint/jsplugin (#19095) (Francesco Trotta)Bug Fixes
fd33f13fix: update types forno-restricted-importsrule (#19060) (Nitin Kumar)bd35098fix: switch away from Node.js node:assert and AssertionError (#19082) (Josh Goldberg ✨)9db5b15fix: unsafe report forno-lonely-if(#19087) (Abraham Guo)68fa497fix: ignore files on a different drive on Windows (#19069) (Francesco Trotta)4ce625afix: upgrade @ humanwhocodes/[email protected] to avoid debug logs (#19102) (Milos Djermanovic)Documentation
d927920docs: fix styles in no-js mode (#18916) (Tanuj Kanti)09bc2a8docs: Update README (GitHub Actions Bot)39089c8docs: addno-useless-computed-keyexamples with object patterns (#19109) (Milos Djermanovic)895c60fdocs: add missing messageId property and suggestion properties (#19122) (fnx)298625edocs: Change CLI -c to use flat config (#19103) (Nicholas C. Zakas)522d8a3docs: add deprecation onindent,quotesandsemirule types (#19090) (Marco Pasqualetti)Chores
2967d91chore: upgrade @ eslint/[email protected] (#19133) (Milos Djermanovic)b441beechore: package.json update for @ eslint/js release (Jenkins)7d6bf4achore: upgrade @ eslint/[email protected] (#19131) (Milos Djermanovic)902e707chore: upgrade @ eslint/[email protected] (#19130) (Milos Djermanovic)5ff6c1dchore: bump cross-spawn (#19125) (Ian Bobinac)cceccc7chore: update dependency @ eslint/json to ^0.6.0 (#19117) (renovate[bot])0da3f73chore: update algolia referrer (#19114) (Strek)4f08332ci: unpintrunk-io/trunk-action(#19108) (Francesco Trotta)6b75683perf: optimizetext-tableby replacing regex withtrimEnd(#19061) (Nitin Kumar)Features
3fa009ffeat: add support for Import Attributes and RegExp Modifiers (#19076) (Milos Djermanovic)b0faee3feat: add types for the@ eslint/jspackage (#19010) (Nitin Kumar)Bug Fixes
24d0172fix: enable retry concurrency limit for readFile() (#19077) (Nicholas C. Zakas)b442067fix: Don't crash when directory is deleted during traversal. (#19067) (Nicholas C. Zakas)d474443fix: avoid call stack overflow while processing globs (#19035) (Livia Medeiros)Documentation
151c965docs: updatecontext.languageOptions.parserdescription (#19084) (Nitin Kumar)dc34f94docs: Update README (GitHub Actions Bot)f16e846docs: Update README (GitHub Actions Bot)ee0a77edocs: change link from @ types/eslint to lib/types (#19049) (Karl Horky)50f03a1docs: Clarify global ignores in config migration guide (#19032) (Milos Djermanovic)Build Related
37c9177build: update@ wdio/*dependencies (#19068) (Francesco Trotta)35a8858build: exclude flawed dendency versions (#19065) (Francesco Trotta)Chores
f36cb16chore: upgrade @ eslint/[email protected] (#19086) (Milos Djermanovic)28be447chore: package.json update for @ eslint/js release (Jenkins)f48a2a0test: addno-invalid-regexptests with RegExp Modifiers (#19075) (Milos Djermanovic)425202eperf: Fix caching in config loaders (#19042) (Milos Djermanovic)3d44b3cci: run tests in Node.js 23 (#19055) (Francesco Trotta)7259627test: ensure tmp directory cleanup incheck-emfile-handling.js(#19036) (Livia Medeiros)Features
381c32bfeat: Allow languages to providedefaultLanguageOptions(#19003) (Milos Djermanovic)bf723bdfeat: Improve eslintrc warning message (#19023) (Milos Djermanovic)1def4cdfeat: drop support for jiti v1.21 (#18996) (Francesco Trotta)f879be2feat: exportESLint.defaultConfig(#18983) (Nitin Kumar)Bug Fixes
78836d4fix: update thecomplexityrule type (#19027) (Nitin Kumar)064c8b6fix: update rule types (#18925) (Nitin Kumar)Documentation
abdbfa8docs: markLintMessage#nodeTypeas deprecated (#19019) (Nitin Kumar)19e68d3docs: update deprecated rules type definitions (#19018) (Nitin Kumar)7dd402ddocs: Update examples of passing multiple values to a CLI option (#19006) (Milos Djermanovic)5dcbc51docs: Add example with side-effect imports to no-restricted-imports (#18997) (Milos Djermanovic)1ee87cadocs: Update README (GitHub Actions Bot)2c3dbdcdocs: Use prerendered sponsors for README (#18988) (Milos Djermanovic)Chores
68d2d9dchore: upgrade to@ eslint/[email protected]and@ eslint/core@^0.7.0(#19034) (Francesco Trotta)2211f0achore: package.json update for @ eslint/js release (Jenkins)c7abaefperf: using Node.js compile cache (#19012) (唯然)1d7c077chore: add pkg.type "commonjs" (#19011) (唯然)468e3bdtest: fixESLinttests (#19021) (Francesco Trotta)ed4635fci: upgrade [email protected] (#18992) (Milos Djermanovic)efad767chore: remove unused ignore dependency (#18993) (Amaresh S M)Features
5a6a053feat: update tojitiv2 (#18954) (Arya Emami)17a07fbfeat: Hooks for test cases (RuleTester) (#18771) (Anna Bocharova)2ff0e51feat: Implement alternate config lookup (#18742) (Nicholas C. Zakas)2d17453feat: Implement modified cyclomatic complexity (#18896) (Dmitry Pashkevich)Bug Fixes
ea380cafix: Upgrade retry to avoid EMFILE errors (#18986) (Nicholas C. Zakas)fdd6319fix: Issues with type definitions (#18940) (Arya Emami)Documentation
ecbd522docs: Mention code explorer (#18978) (Nicholas C. Zakas)7ea4eccdocs: Clarifying the Use of Meta Objects (#18697) (Amaresh S M)d3e4b2edocs: Clarify how to exclude.jsfiles (#18976) (Milos Djermanovic)57232ffdocs: Mention plugin-kit in language docs (#18973) (Nicholas C. Zakas)b80ed00docs: Update README (GitHub Actions Bot)cb69ab3docs: Update README (GitHub Actions Bot)7fb0d95docs: Update README (GitHub Actions Bot)493348adocs: Update README (GitHub Actions Bot)87a582cdocs: fix typo inid-matchrule (#18944) (Jay)Chores
555aafdchore: upgrade to@ eslint/[email protected](#18987) (Francesco Trotta)873ae60chore: package.json update for @ eslint/js release (Jenkins)d0a5414refactor: replace strip-ansi with native module (#18982) (Cristopher)b827029chore: Enable JSON5 linting (#18979) (Milos Djermanovic)8f55ca2chore: Upgrade espree, eslint-visitor-keys, eslint-scope (#18962) (Nicholas C. Zakas)c1a2725chore: update dependency mocha to ^10.7.3 (#18945) (Milos Djermanovic)Bug Fixes
20fd916fix: add@ eslint/core,@ types/estree, &@ types/json-schemadeps (#18938) (Nitin Kumar)2738322fix: add missing types forrequire-atomic-updatesrule (#18937) (Kristóf Poduszló)d71ff30fix: add missing types forobject-shorthandrule (#18935) (Kristóf Poduszló)561cadcfix: add missing types forno-unsafe-negationrule (#18932) (Kristóf Poduszló)8843656fix: add missing types forno-underscore-danglerule (#18931) (Kristóf Poduszló)92cde5cfix: add missing types forno-shadowrule (#18930) (Kristóf Poduszló)b3cbe11fix: add missing types forno-sequencesrule (#18929) (Kristóf Poduszló)976f77ffix: add missing types forno-unused-expressionsrule (#18933) (Kristóf Poduszló)Documentation
3eff709docs: replace deprecatedLinter.FlatConfigtype withLinter.Config(#18941) (Carlos Meira)Chores
df4a859chore: upgrade @ eslint/[email protected] (#18943) (Milos Djermanovic)36d8095chore: package.json update for @ eslint/js release (Jenkins)Features
ec30c73feat: add "eslint/universal" to exportLinter(#18883) (唯然)c591da6feat: Add language to types (#18917) (Nicholas C. Zakas)492eb8ffeat: limit the name given toImportSpecifierinid-length(#18861) (Tanuj Kanti)19c6856feat: Addno-useless-constructorsuggestion (