chore(deps): update dependency eslint to ^9.21.0 [security] #1201
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
renovate
bot
force-pushed
the
renovate/npm-eslint-vulnerability
branch
from
98b0aa7 to
7989714
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^9.39.2→^9.21.0GitHub Vulnerability Alerts
CVE-2025-50537
There is a Stack Overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in
eslint/lib/shared/serialization.js. The exploit is triggered via theRuleTester.run()method, which validates test cases and checks for duplicates. During validation, the internal functioncheckDuplicateTestCase()is called, which in turn uses theisSerializable()function for serialization checks. When a circular reference object is passed in,isSerializable()enters infinite recursion, ultimately causing a Stack Overflow.Release Notes
eslint/eslint (eslint)
v9.26.0Compare Source
Features
e9754e7feat: add reportGlobalThis to no-shadow-restricted-names (#19670) (sethamus)0fa2b7afeat: add suggestions foreqeqeqrule (#19640) (Nitin Kumar)dcbdcc9feat: Add MCP server (#19592) (Nicholas C. Zakas)2dfd83efeat: addignoreDirectivesoption inno-unused-expressions(#19645) (sethamus)Bug Fixes
96e84defix: check cache file existence before deletion (#19648) (sethamus)d683aebfix: don't crash on tests with circular references inRuleTester(#19664) (Milos Djermanovic)9736d5dfix: addnamespacetoPlugin.metatype (#19661) (Milos Djermanovic)17bae69fix: updateRuleTester.run()type (#19634) (Nitin Kumar)Documentation
dd98d63docs: Update README (GitHub Actions Bot)c25e858docs: Update README (GitHub Actions Bot)b2397e9docs: Update README (GitHub Actions Bot)addd0a6docs: fix formatting of unordered lists in Markdown (#19660) (Milos Djermanovic)a21b38ddocs: Update README (GitHub Actions Bot)c0721a7docs: fix double space in command (#19657) (CamWass)Chores
5b247c8chore: upgrade to@eslint/js@9.26.0(#19681) (Francesco Trotta)d6fa4acchore: package.json update for @eslint/js release (Jenkins)0958690chore: disambiguate internal typesLanguageOptionsandRule(#19669) (Francesco Trotta)f1c858echore: fix internal type references toPluginandRule(#19665) (Francesco Trotta)40dd299refactor: One-shot ESQuery selector analysis (#19652) (Nicholas C. Zakas)1cfd702chore: update dependency @eslint/json to ^0.12.0 (#19656) (renovate[bot])v9.25.1Compare Source
Bug Fixes
cdc8e8cfix: revert directive detection in no-unused-expressions (#19639) (sethamus)Chores
1f2b057chore: upgrade @eslint/js@9.25.1 (#19642) (Milos Djermanovic)771317fchore: package.json update for @eslint/js release (Jenkins)v9.25.0Compare Source
Features
dcd95aafeat: support TypeScript syntax in no-empty-function rule (#19551) (sethamus)77d6d5bfeat: support TS syntax inno-unused-expressions(#19564) (Sweta Tanwar)90228e5feat: supportJSRuleDefinitiontype (#19604) (루밀LuMir)59ba6b7feat: add allowObjects option to no-restricted-properties (#19607) (sethamus)db650a0feat: support TypeScript syntax inno-invalid-thisrule (#19532) (Tanuj Kanti)9535cfffeat: support TS syntax inno-loop-func(#19559) (Nitin Kumar)Bug Fixes
910bd13fix:nodeTypeKeynot being used inNodeEventGenerator(#19631) (StyleShit)Documentation
ca7a735docs: updateno-undef-initwhen not to use section (#19624) (Tanuj Kanti)1b870c9docs: useeslint-config-xoin the getting started guide (#19629) (Nitin Kumar)5d4af16docs: add types for multiple rule options (#19616) (Tanuj Kanti)e8f8d57docs: Update README (GitHub Actions Bot)a40348fdocs: no-use-before-define tweaks (#19622) (Kirk Waiblinger)0ba3ae3docs: Update README (GitHub Actions Bot)865dbfedocs: ensure "learn more" deprecation links point to useful resource (#19590) (Kirk Waiblinger)f80b746docs: add known limitations for no-self-compare (#19612) (Nitin Kumar)865aed6docs: Update README (GitHub Actions Bot)Chores
88dc196chore: upgrade @eslint/js@9.25.0 (#19636) (Milos Djermanovic)345288dchore: package.json update for @eslint/js release (Jenkins)affe6bechore: upgrade trunk (#19628) (sethamus)dd20cf2test: fixno-loop-functest with duplicate variable reports (#19610) (Milos Djermanovic)bd05397chore: upgrade@eslint/*dependencies (#19606) (Milos Djermanovic)22ea18bchore: replace invalidinttype withnumberinside JSDocs. (#19597) (Arya Emami)v9.24.0Compare Source
Features
556c25bfeat: support loading TS config files using--experimental-strip-types(#19401) (Arya Emami)72650acfeat: support TS syntax ininit-declarations(#19540) (Nitin Kumar)03fb0bcfeat: normalize patterns to handle "./" prefix in files and ignores (#19568) (Pixel998)071dcd3feat: support TS syntax inno-dupe-class-members(#19558) (Nitin Kumar)cd72bccfeat: Introduce a way to suppress violations (#19159) (Iacovos Constantinou)2a81578feat: support TS syntax inno-loss-of-precision(#19560) (Nitin Kumar)30ae4edfeat: add new options to class-methods-use-this (#19527) (sethamus)b79ade6feat: support TypeScript syntax inno-array-constructor(#19493) (Tanuj Kanti)Bug Fixes
b23d1c5fix: deduplicate variable names in no-loop-func error messages (#19595) (Nitin Kumar)fb8cdb8fix: useany[]type forcontext.options(#19584) (Francesco Trotta)Documentation
f857820docs: update documentation for--experimental-strip-types(#19594) (Nikolas Schröter)803e4afdocs: simplify gitignore path handling in includeIgnoreFile section (#19596) (Thomas Broyer)6d979ccdocs: Update README (GitHub Actions Bot)82177e4docs: Update README (GitHub Actions Bot)e849dc0docs: replace existing var with const (#19578) (Sweta Tanwar)0c65c62docs: don't pass filename when linting rule examples (#19571) (Milos Djermanovic)6be36c9docs: Update custom-rules.md code example of fixer (#19555) (Yifan Pan)Build Related
366e369build: re-enable Prettier formatting forpackage.jsonfiles (#19569) (Francesco Trotta)Chores
ef67420chore: upgrade @eslint/js@9.24.0 (#19602) (Milos Djermanovic)4946847chore: package.json update for @eslint/js release (Jenkins)a995acbchore: correct 'flter'/'filter' typo in package script (#19587) (Josh Goldberg ✨)b9a5efatest: skip symlink test on Windows (#19503) (fisker Cheung)46eea6dchore: removeRule&FormatterFunctionfromshared/types.js(#19556) (Nitin Kumar)bdcc91dchore: modify .editorconfig to keep parity with prettier config (#19577) (Sweta Tanwar)7790d83chore: fix some typos in comment (#19576) (todaymoon)76064a6test: ignorepackage-lock.jsonforeslint-webpack-plugin(#19572) (Francesco Trotta)v9.23.0Compare Source
Features
557a0d2feat: support TypeScript syntax in no-useless-constructor (#19535) (Josh Goldberg ✨)8320241feat: support TypeScript syntax indefault-param-last(#19431) (Josh Goldberg ✨)833c4a3feat: defineConfig() supports "flat/" config prefix (#19533) (Nicholas C. Zakas)4a0df16feat: circular autofix/conflicting rules detection (#19514) (Milos Djermanovic)be56a68feat: support TypeScript syntax inclass-methods-use-this(#19498) (Josh Goldberg ✨)Bug Fixes
0e20aa7fix: move deprecatedRuleContextmethods to subtype (#19531) (Francesco Trotta)cc3bd00fix: reporting variable used in catch block inno-useless-assignment(#19423) (Tanuj Kanti)d46ff83fix:no-dupe-keysfalse positive with proto setter (#19508) (Milos Djermanovic)e732773fix: navigation of search results on pressing Enter (#19502) (Tanuj Kanti)f4e9c5ffix: allowRuleTesterto test files insidenode_modules/(#19499) (fisker Cheung)Documentation
5405939docs: show red underlines in TypeScript examples in rules docs (#19547) (Milos Djermanovic)48b53d6docs: replace var with const in examples (#19539) (Nitin Kumar)c39d7dbdocs: Update README (GitHub Actions Bot)a4f8760docs: revert accidental changes (#19542) (Francesco Trotta)280128fdocs: add copy button (#19512) (xbinaryx)cd83eaadocs: replacevarwithconstin examples (#19530) (Nitin Kumar)7ff0cdedocs: Update README (GitHub Actions Bot)996cfb9docs: migrate sass to module system (#19518) (xbinaryx)17cb958docs: replacevarwithletandconstin rule examples (#19515) (Tanuj Kanti)83e24f5docs: Replace var with let or const (#19511) (Jenna Toff)a59d0c0docs: Update docs for defineConfig (#19505) (Nicholas C. Zakas)fe92927docs:require-unicode-regexpadd note foriflag and\w(#19510) (Chaemin-Lim)Build Related
2357eddbuild: exclude autogenerated files from Prettier formatting (#19548) (Francesco Trotta)Chores
0ac8ea4chore: update dependencies for v9.23.0 release (#19554) (Francesco Trotta)20591c4chore: package.json update for @eslint/js release (Jenkins)901344fchore: update dependency @eslint/json to ^0.11.0 (#19552) (renovate[bot])5228383chore: fix update-readme formatting (#19544) (Milos Djermanovic)5439525chore: format JSON files in Trunk (#19541) (Francesco Trotta)75adc99chore: enabled Prettier in Trunk (#19354) (Josh Goldberg ✨)2395168chore: added .git-blame-ignore-revs for Prettier via trunk fmt (#19538) (Josh Goldberg ✨)129882dchore: formatted files with Prettier via trunk fmt (#19355) (Josh Goldberg ✨)1738dbcchore: temporarily disable prettier in trunk (#19537) (Josh Goldberg ✨)dc854fdchore: update dependency shelljs to ^0.9.0 (#19524) (renovate[bot])5d57496chore: fix some comments (#19525) (jimmycathy)9c5c6eetest: fix an assertion failure (#19500) (fisker Cheung)7a699a6chore: remove formatting-related lint rules internally (#19473) (Josh Goldberg ✨)c99db89test: replace WebdriverIO with Cypress (#19465) (Pixel998)v9.22.0Compare Source
Features
7ddb095feat: Export defineConfig, globalIgnores (#19487) (Nicholas C. Zakas)Bug Fixes
19c0127fix: improve message forno-consolesuggestions (#19483) (Francesco Trotta)49e624ffix: improve error message for falsy parsed JS AST (#19458) (Josh Goldberg ✨)Documentation
86c5f37docs: Update README (GitHub Actions Bot)fbdeff0docs: Update README (GitHub Actions Bot)c9e8510docs: generate deprecation notice in TSDoc comments from rule metadata (#19461) (Francesco Trotta)2f386addocs: replacevarwithconstin rule examples (#19469) (Tanuj Kanti)0e688e3docs: Update README (GitHub Actions Bot)06b596ddocs: Restore the carrot to the position where the search input was lost (#19459) (Amaresh S M)Chores
97f788bchore: upgrade @eslint/js@9.22.0 (#19489) (Milos Djermanovic)eed409achore: package.json update for @eslint/js release (Jenkins)f9a56d3chore: upgrade eslint-scope@8.3.0 (#19488) (Milos Djermanovic)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.