🚨 [security] Update eslint 8.56.0 → 9.39.2 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.56.0 → 9.39.2) · Repo · Changelog

Security Advisories 🚨

🚨 eslint has a Stack Overflow when serializing objects with circular references

There is a Stack Overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a Stack Overflow.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​eslint/eslintrc (indirect, 2.1.4 → 3.3.3) · Repo · Changelog

Release Notes

3.3.3 (from changelog)

Bug Fixes

• release v3.3.3 because publishing v3.3.2 failed (#211) (8aa555a)

3.3.1

3.3.1 (2025-03-11)

Bug Fixes

• correct types field in package.json (#184) (2f4cf3f)

3.3.0

3.3.0 (2025-02-21)

Features

• Add types to package (#179) (cb546be)

3.2.0

3.2.0 (2024-11-14)

Features

• merge rule.meta.defaultOptions before validation (#166) (d02f914)

3.1.0

3.1.0 (2024-05-17)

Features

• Expose loadConfigFile() function (#160) (59e890f)

Chores

• run tests in Node.js 22 (#154) (5e526f2)
• update dependency shelljs to ^0.8.5 (#156) (903b887)

3.0.2

3.0.2 (2024-02-12)

Chores

• maintenance update of globals to v14 (#152) (4151865)

3.0.1

3.0.1 (2024-02-09)

Documentation

• fix changelog for v3.0.0 (#144) (a613847)
• More explicit about all and recommended configs (#150) (0fabc74)

Chores

• upgrade espree@10.0.1 (#151) (8c39944)

3.0.0

3.0.0 (2023-12-27)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#142)
• Set default schema: [], drop support for function-style rules (#139)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#142) (737eb25)
• Set default schema: [], drop support for function-style rules (#139) (a6c240d)

Chores

• upgrade github actions (#143) (de34faf)

Does any of this look wrong? Please let us know.

↗️ @​eslint/js (indirect, 8.56.0 → 9.39.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ acorn (indirect, 8.11.2 → 8.15.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes

• update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes

• fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes

• disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ eslint-scope (indirect, 7.2.2 → 8.4.0) · Repo · Changelog

Release Notes

8.0.2

8.0.2 (2024-07-08)

Bug Fixes

• Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)

Documentation

• document Security Policy (#122) (0d03700)

Chores

• switch to eslint flat config (#121) (59b1606)
• upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)

⚠ BREAKING CHANGES

• use ESTree directive property when searching for "use strict" (#118)
• class extends is evaluated in the class scope (#116)
• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
• use ESTree directive property when searching for "use strict" (#118) (23fe81f)

Bug Fixes

• class extends is evaluated in the class scope (#116) (42ef7a9)

Documentation

• Update README with analyze() options (#111) (2122fdb), closes #110

Chores

• Remove add-to-triage (#106) (dc75851)
• run tests in Node.js 21 (#109) (957748e)
• standardize npm script names (#105) (115ded3)

Does any of this look wrong? Please let us know.

↗️ eslint-visitor-keys (indirect, 3.4.3 → 4.2.1) · Repo · Changelog

Release Notes

4.0.0

4.0.0 (2024-02-08)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#63)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#63) (388b2ac)

Chores

• run tests in Node.js 21 (#61) (b23bfb7)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.6.1 → 10.4.0) · Repo · Changelog

Release Notes

10.4.0 (from changelog)

Features

• Add support for ES2026 using and await using declarations (#658) (39e0865)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.2.0 to ^4.2.1

10.3.0 (from changelog)

Features

• add support for Import Attributes and RegExp Modifiers (#639) (2fd4222)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.1.0 to ^4.2.0

10.2.0 (from changelog)

Features

• add the eslint-scope package (#615) (2ecfb8b)

Bug Fixes

• Update dependencies to avoid build failure (#631) (e8cd107)
• update links to eslint/js repo (#619) (956389a)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.0.0 to ^4.1.0

10.1.0

10.1.0 (2024-06-17)

Features

• Support ES2025 and RegExp duplicate named capturing groups (#608) (3059713)

10.0.1

10.0.1 (2024-02-09)

Chores

• upgrade eslint-visitor-keys@4.0.0 (#595) (6254a91)

10.0.0

10.0.0 (2024-01-25)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#589)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#589) (e79cfa4)

Bug Fixes

• upgrade acorn v8.11.3 (#590) (6d30382)

Chores

• Add PRs to triage project (#580) (086555e)
• Remove add-to-triage (#583) (3907385)
• run tests in Node.js 21 (#585) (1584ddb)
• standardize npm script names (#582) (b0767ef)
• use eslint-config-eslint@9.0.0 (#584) (ec949bc)

Does any of this look wrong? Please let us know.

↗️ esquery (indirect, 1.4.2 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ file-entry-cache (indirect, 6.0.1 → 8.0.0) · Repo · Changelog

Release Notes

8.0.0

Removing support for Nodejs 10, 12, and 14

This is updating modules to the latest versions and supporting Nodejs >=16 moving forward with v8.0.0

What's Changed

• removing support for nodejs 12 and 14 by @jaredwray in #43

Full Changelog: v7.0.2...v8.0.0

7.0.2

What's Changed

• removing del module as no longer needed by @jaredwray in #40
• upgrading flat-cache to 3.2.0 by @jaredwray in #41

Full Changelog: v7.0.1...v7.0.2

7.0.1

What's Changed

• upgrading flat-cache to 3.1.1 by @jaredwray in #37
• upgrading chai to 4.3.10 by @jaredwray in #38
• upgrading eslint to 8.50.0 and mocha plugin by @jaredwray in #39

Full Changelog: v7.0.0...v7.0.1

7.0.0

What's Changed

• upgrading chai and mocha to latest by @jaredwray in #32
• removing package-lock and setting tests to nodejs versions by @jaredwray in #33
• adding code coverage reporting via codecov by @jaredwray in #34
• updating tests for master by @jaredwray in #35
• removing support for Nodejs version 10 by @jaredwray in #36

Full Changelog: v6.0.1...v7.0.0

Does any of this look wrong? Please let us know.

↗️ flat-cache (indirect, 3.0.4 → 4.0.1) · Repo · Changelog

Release Notes

4.0.1

What's Changed

• removing rimraf as core dependency by @jaredwray in #87
• chore: run prettier separately from eslint by @uncenter in #88
• refactor: prefer let/const over var by @uncenter in #89
• upgrading c8 to 9.1.0 by @jaredwray in #92
• upgrading prettier to 3.2.4 by @jaredwray in #93
• upgrading moch to 10.3.0 by @jaredwray in #95
• removing parts of keyv as a dependency by @jaredwray in #97

New Contributors

• @uncenter made their first contribution in #88

Full Changelog: v4.0.0...v4.0.1

4.0.0

Major version release

To stay up to date with latest module dependencies we moved to supporting nodejs >=16 with this release. All other functionality stayed the same.

What's Changed

• removing the testing on 21 by @jaredwray in #85
• removing support for node 10, 12, and 14 by @jaredwray in #86

Full Changelog: v3.2.0...v4.0.0

3.2.0

What's Changed

• [Fix] restore node 10 compat by @ljharb in #81

New Contributors

• @ljharb made their first contribution in #81

Full Changelog: v3.1.1...v3.2.0

3.1.1

What's Changed

• updating repo to use github actions and codecov by @jaredwray in #64
• updating mocha and chai by @jaredwray in #65
• adding in codecov badge by @jaredwray in #66
• upgrading flatted to 3.2.7 by @jaredwray in #67
• updating workflows with prs by @jaredwray in #71
• updating coverage reporting to work with codecov by @jaredwray in #72
• updating to show correct branch by @jaredwray in #73
• intoducing keyv to flat-cache - non invasive by @jaredwray in #74
• clean up of package.json by @jaredwray in #75
• upgrading chai to 4.3.10 by @jaredwray in #77
• upgrading flatted to 3.2.9 by @jaredwray in #78

New Contributors

• @jaredwray made their first contribution in #64

Full Changelog: v3.0.4...v3.1.1

Does any of this look wrong? Please let us know.

↗️ flatted (indirect, 3.2.4 → 3.3.3) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ globals (indirect, 13.23.0 → 14.0.0) · Repo

Release Notes

14.0.0

Breaking

• Require Node.js 18 8ef880e

Improvements

• Zero dependencies (#209) da83698

v13.24.0...v14.0.0

13.24.0

• Add WebXR classes to browser (#206) 6736d9c

v13.23.0...v13.24.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ignore (indirect, 5.3.0 → 5.3.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ import-fresh (indirect, 3.3.0 → 3.3.1) · Repo

Release Notes

3.3.1

• Fix Bun compatibility (#32) 972690b

---

v3.3.0...v3.3.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 @​eslint/config-array (added, 0.21.1)

🆕 @​eslint/config-helpers (added, 0.4.2)

🆕 @​eslint/core (added, 0.17.0)

🆕 @​eslint/object-schema (added, 2.1.7)

🆕 @​eslint/plugin-kit (added, 0.4.1)

🆕 @​humanfs/core (added, 0.19.1)

🆕 @​humanfs/node (added, 0.16.7)

🆕 @​humanwhocodes/retry (added, 0.4.3)

🆕 @​types/estree (added, 1.0.8)

🆕 @​types/json-schema (added, 7.0.15)

🆕 json-buffer (added, 3.0.1)

🆕 keyv (added, 4.5.4)

🗑️ @​humanwhocodes/config-array (removed)

🗑️ @​humanwhocodes/object-schema (removed)

🗑️ @​nodelib/fs.scandir (removed)

🗑️ @​nodelib/fs.stat (removed)

🗑️ @​nodelib/fs.walk (removed)

🗑️ @​ungap/structured-clone (removed)

🗑️ doctrine (removed)

🗑️ fastq (removed)

🗑️ graphemer (removed)

🗑️ is-path-inside (removed)

🗑️ queue-microtask (removed)

🗑️ reusify (removed)

🗑️ run-parallel (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)