🚨 [security] Update eslint 8.10.0 → 9.39.2 (major)

[depfu]

---

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

---

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.10.0 → 9.39.2) · Repo · Changelog

Security Advisories 🚨

🚨 eslint has a Stack Overflow when serializing objects with circular references

There is a Stack Overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a Stack Overflow.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 7 commits:

• 9.39.2
• Build: changelog update for 9.39.2
• chore: upgrade to `@eslint/js@9.39.2` (#20394)
• chore: package.json update for @eslint/js release
• fix: warn when `eslint-env` configuration comments are found (#20381)
• build: add .scss files entry to knip (#20391)
• ci: add `v9.x-dev` branch (#20382)

↗️ @​eslint/eslintrc (indirect, 1.2.0 → 3.3.3) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ @​types/json-schema (indirect, 7.0.9 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.7.0 → 8.15.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes

• update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes

• fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes

• disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

• chore(release): 7.0.6
• chore: upgrade standard-version
• fix: update cross-spawn version to 7.0.5 in package-lock.json
• chore: fix build status badge
• chore(release): 7.0.5
• fix: fix escaping bug introduced by backtracking
• chore: remove codecov
• chore: replace travis with github workflows
• chore(release): 7.0.4
• fix: disable regexp backtracking (#160)
• chore: fix tests in recent node js versions
• chore: convert package lock
• chore: remove unused argument (#156)
• chore: add travis jobs on ppc64le (#142)
• chore: fix audit warning

↗️ espree (indirect, 9.3.1 → 10.4.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ flatted (indirect, 3.2.5 → 3.3.3) · Repo

Commits

See the full diff on Github. The new version differs by 39 commits:

• 3.3.3
• ruf/linted Python + dev-dependencies updates
• explicit files in package.json
• 3.3.2
• Fix #81 - Removed published __pycache__ from npm
• 3.3.1
• Fixed another typo on TS definition
• 3.3.0
• Fixed types and TS logo in npm
• Removed jsr.json from npm
• 3.2.13
• Fixed typo in JSDoc TS
• 3.2.12
• Last attempt to fix jsr.io
• Still trying to fix jsr.io publishing
• 3.2.11
• Improved TS types
• Bumped jsr.io too
• 3.2.10
• Trying this jsr thing
• Updated dev-dependencies
• Updated all dev/dependencies
• Merge pull request #71 from WebReflection/python
• 3.2.9
• Added Python version of the very same thing
• 3.2.8
• Merge pull request #70 from WebReflection/issue-69
• Fix #69 - Make `$value` an explicit class field
• Removed a disturbingly unnecessary early return
• Merge pull request #63 from WebReflection/dependabot/npm_and_yarn/json5-2.2.3
• Bump json5 from 2.2.1 to 2.2.3
• 3.2.7
• Updated dev-dependencies
• Merge pull request #60 from Fdawgs/patch-1
• Reduce published package size
• 3.2.6
• Fix #58 + updated dev dependencies + exported flatted/esm
• Merge pull request #55 from WebReflection/dependabot/npm_and_yarn/minimist-1.2.6
• Bump minimist from 1.2.5 to 1.2.6

↗️ globals (indirect, 13.13.0 → 14.0.0) · Repo

Release Notes

14.0.0

Breaking

• Require Node.js 18 8ef880e

Improvements

• Zero dependencies (#209) da83698

v13.24.0...v14.0.0

13.24.0

• Add WebXR classes to browser (#206) 6736d9c

v13.23.0...v13.24.0

13.23.0

• Add ToggleEvent to browser (#203) bcddbf3

v13.22.0...v13.23.0

13.22.0

• Add MediaStreamConstraints to browser (#202) ecef06f

v13.21.0...v13.22.0

13.21.0

• Add missing Node.js and browser globals (#200) 8eeba3b

v13.20.0...v13.21.0

13.20.0

• Add missing Fetch API globals for Node.js (#197) ff81cf5

v13.19.0...v13.20.0

13.19.0

• Add NavigatorUAData to browser (#196) fd7d4ed

v13.18.0...v13.19.0

13.18.0

• Add ClipboardItem to browser (#194) 9a59ec7

v13.17.0...v13.18.0

13.17.0

• Add missing events to browser, worker, service worker environments (#192) 0bfae5d
• Add TransformStream for browser (#193) 972bfd9

v13.16.0...v13.17.0

13.16.0

• Add reportError (#191) 70a6373

v13.15.0...v13.16.0

13.15.0

• Add structuredClone for browser (#190) 2efa3d0

v13.14.0...v13.15.0

13.14.0

• Add fetch global for Node.js (#189) 508d431

v13.13.0...v13.14.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 28 commits:

• 14.0.0
• Require Node.js 18
• Generate types rather than relying on `type-fest` (#209)
• Add script to get builtin globals (#207)
• 13.24.0
• Meta tweaks
• Add WebXR classes to `browser` (#206)
• 13.23.0
• Add `ToggleEvent` to `browser` (#203)
• 13.22.0
• Add `MediaStreamConstraints` to `browser` (#202)
• 13.21.0
• Add missing Node.js and browser globals (#200)
• 13.20.0
• Add missing Fetch API globals for Node.js (#197)
• 13.19.0
• Add `NavigatorUAData` to browser (#196)
• 13.18.0
• Add `ClipboardItem` to browser (#194)
• 13.17.0
• Add missing events to browser, worker, service worker environments (#192)
• Add `TransformStream` for browser (#193)
• 13.16.0
• Add `reportError` (#191)
• 13.15.0
• Add `structuredClone` for browser (#190)
• 13.14.0
• Add `fetch` global for Node.js (#189)

↗️ js-yaml (indirect, 4.1.0 → 4.1.1) · Repo · Changelog

Security Advisories 🚨

🚨 js-yaml has prototype pollution in merge (<<)

Impact

In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted.

Patches

Problem is patched in js-yaml 4.1.1 and 3.14.2.

Workarounds

You can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).

References

https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html

Release Notes

4.1.1 (from changelog)

Security

• Fix prototype pollution issue in yaml merge (<<) operator.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

• 4.1.1 released
• dist rebuild
• lint fix
• fix prototype pollution in merge (<<)
• README.md: HTTP => HTTPS (#678)
• doc: 'empty' style option for !!null
• Fix demo link (#618)

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:

Reverts default value for options.indent to two spaces ' '.

Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed

• Remove default indent by @mohd-akram in #24
• 🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
• 🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
• chore: publish workflow by @OlafConijn in #42

New Contributors

• @mohd-akram made their first contribution in #24
• @OlafConijn made their first contribution in #41
• @aashutoshrathi made their first contribution in #33

Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

• 1.2.5
• revert default indent
• run verb to generate README
• Merge pull request #42 from jonschlinkert/chore/publish-workflow
• Merge pull request #41 from jonschlinkert/fix/CVE-2023-26115-2
• Update .github/workflows/publish.yml
• chore: bump version to 1.2.4
• chore: add publish workflow
• chore: fix test
• chore: remove package-lock
• chore: added an additional testcase
• fix: cve 2023-26115
• fix: settle for new regex to support lower node versions
• :lock: fix: CVE-2023-26115
• Merge pull request #24 from mohd-akram/remove-default-indent
• Remove default indent

🆕 @​eslint-community/eslint-utils (added, 4.9.1)

🆕 @​eslint-community/regexpp (added, 4.12.2)

🆕 @​eslint/config-array (added, 0.21.1)

🆕 @​eslint/config-helpers (added, 0.4.2)

🆕 @​eslint/core (added, 0.17.0)

🆕 @​eslint/js (added, 9.39.2)

🆕 @​eslint/object-schema (added, 2.1.7)

🆕 @​eslint/plugin-kit (added, 0.4.1)

🆕 @​humanfs/core (added, 0.19.1)

🆕 @​humanfs/node (added, 0.16.7)

🆕 @​humanwhocodes/module-importer (added, 1.0.1)

🆕 @​humanwhocodes/retry (added, 0.4.3)

🆕 json-buffer (added, 3.0.1)

🆕 keyv (added, 4.5.4)

🆕 yocto-queue (added, 0.1.0)

🗑️ @​humanwhocodes/config-array (removed)

🗑️ @​humanwhocodes/object-schema (removed)

🗑️ @​popperjs/core (removed)

🗑️ doctrine (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)