🚨 [security] Update eslint 8.25.0 → 10.0.0 (major) by depfu[bot] · Pull Request #49 · https-quantumblockchainai-atlassian-net/metalsmith-netlify-starter

depfu · 2026-02-13T22:45:20Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.25.0 → 10.0.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ acorn (indirect, 8.8.0 → 8.15.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes

update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes

fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes

disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 7.1.1 → 9.1.0) · Repo · Changelog

Release Notes

8.0.2

8.0.2 (2024-07-08)

Bug Fixes

Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)

Documentation

document Security Policy (#122) (0d03700)

Chores

switch to eslint flat config (#121) (59b1606)

upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)

⚠ BREAKING CHANGES

use ESTree directive property when searching for "use strict" (#118)

class extends is evaluated in the class scope (#116)

Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)

Features

Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)

use ESTree directive property when searching for "use strict" (#118) (23fe81f)

Bug Fixes

class extends is evaluated in the class scope (#116) (42ef7a9)

Documentation

Update README with analyze() options (#111) (2122fdb), closes #110

Chores

Remove add-to-triage (#106) (dc75851)

run tests in Node.js 21 (#109) (957748e)

standardize npm script names (#105) (115ded3)

7.2.2

7.2.2 (2023-07-27)

Chores

Add PRs to triage (#104) (a4dd888)

generate provenance statements when release (#102) (a27ce6b)

7.2.1

7.2.1 (2023-05-31)

Chores

run tests on Node.js v20 (#97) (675f7de)

set up release-please (#99) (6bc2619)

7.2.0

Features

70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)

Documentation

25abacf docs: add badges (#89) (Milos Djermanovic)

Build Related

a8811b8 build: add node v18 (#91) (唯然)

Chores

3dbad80 chore: add triage action (#95) (Milos Djermanovic)

34ffedc ci: add Node v19 (#94) (Milos Djermanovic)

4c00534 ci: update Github actions (#93) (Deepshika S)

6c8ccf2 chore: add funding field (#92) (Deepshika S)

Does any of this look wrong? Please let us know.

↗️ eslint-visitor-keys (indirect, 3.3.0 → 5.0.0) · Repo · Changelog

Release Notes

4.0.0

4.0.0 (2024-02-08)

⚠ BREAKING CHANGES

Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#63)

Features

Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#63) (388b2ac)

Chores

run tests in Node.js 21 (#61) (b23bfb7)

3.4.3

3.4.3 (2023-08-08)

Chores

Add back add-to-triage (#59) (5ea8b12)

Remove add-to-triage (#56) (45d4c17)

standardize npm script names (#55) (0461695)

update typedef in build keys template (#58) (eb6c66d)

3.4.2

3.4.2 (2023-07-27)

Documentation

fix spelling mistakes (#50) (4ce1c17)

remove release script reference from README (#52) (4640146)

Chores

Add PRs to triage (#54) (a7b64b4)

generate provenance statements when release (#53) (7b09698)

3.4.1

3.4.1 (2023-05-05)

Bug Fixes

correct types for node16 resolution (#47) (7bd1fc1)

Chores

run tests on Node.js v20 (#45) (c982093)

set up release-please (#48) (a7fb4c7)

3.4.0

Features

6ece4bd feat: add JSXSpreadChild and tool to build keys out of AST definitions (#36) (Brett Zamir)

Bug Fixes

e9a070f fix: remove useless sourcemap url (fixes #43) (#44) (余腾靖)

Documentation

4beb7a7 docs: update badges (#37) (Milos Djermanovic)

Build Related

81c0732 build: add node v18 (#39) (唯然)

Chores

0398109 chore: add triage action (#42) (Milos Djermanovic)

bcffbe5 ci: add Node v19 (#41) (Milos Djermanovic)

c24f2e4 chore: update github actions and add funding field (#40) (Deepshika S)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ espree (indirect, 9.4.0 → 11.1.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ file-entry-cache (indirect, 6.0.1 → 8.0.0) · Repo · Changelog

Release Notes

8.0.0

Removing support for Nodejs 10, 12, and 14

This is updating modules to the latest versions and supporting Nodejs >=16 moving forward with v8.0.0

What's Changed

removing support for nodejs 12 and 14 by @jaredwray in #43

Full Changelog: v7.0.2...v8.0.0

7.0.2

What's Changed

removing del module as no longer needed by @jaredwray in #40

upgrading flat-cache to 3.2.0 by @jaredwray in #41

Full Changelog: v7.0.1...v7.0.2

7.0.1

What's Changed

upgrading flat-cache to 3.1.1 by @jaredwray in #37

upgrading chai to 4.3.10 by @jaredwray in #38

upgrading eslint to 8.50.0 and mocha plugin by @jaredwray in #39

Full Changelog: v7.0.0...v7.0.1

7.0.0

What's Changed

upgrading chai and mocha to latest by @jaredwray in #32

removing package-lock and setting tests to nodejs versions by @jaredwray in #33

adding code coverage reporting via codecov by @jaredwray in #34

updating tests for master by @jaredwray in #35

removing support for Nodejs version 10 by @jaredwray in #36

Full Changelog: v6.0.1...v7.0.0

Does any of this look wrong? Please let us know.

↗️ flat-cache (indirect, 3.0.4 → 4.0.1) · Repo · Changelog

Release Notes

4.0.1

What's Changed

removing rimraf as core dependency by @jaredwray in #87

chore: run prettier separately from eslint by @uncenter in #88

refactor: prefer let/const over var by @uncenter in #89

upgrading c8 to 9.1.0 by @jaredwray in #92

upgrading prettier to 3.2.4 by @jaredwray in #93

upgrading moch to 10.3.0 by @jaredwray in #95

removing parts of keyv as a dependency by @jaredwray in #97

New Contributors

@uncenter made their first contribution in #88

Full Changelog: v4.0.0...v4.0.1

4.0.0

Major version release

To stay up to date with latest module dependencies we moved to supporting nodejs >=16 with this release. All other functionality stayed the same.

What's Changed

removing the testing on 21 by @jaredwray in #85

removing support for node 10, 12, and 14 by @jaredwray in #86

Full Changelog: v3.2.0...v4.0.0

3.2.0

What's Changed

[Fix] restore node 10 compat by @ljharb in #81

New Contributors

@ljharb made their first contribution in #81

Full Changelog: v3.1.1...v3.2.0

3.1.1

What's Changed

updating repo to use github actions and codecov by @jaredwray in #64

updating mocha and chai by @jaredwray in #65

adding in codecov badge by @jaredwray in #66

upgrading flatted to 3.2.7 by @jaredwray in #67

updating workflows with prs by @jaredwray in #71

updating coverage reporting to work with codecov by @jaredwray in #72

updating to show correct branch by @jaredwray in #73

intoducing keyv to flat-cache - non invasive by @jaredwray in #74

clean up of package.json by @jaredwray in #75

upgrading chai to 4.3.10 by @jaredwray in #77

upgrading flatted to 3.2.9 by @jaredwray in #78

New Contributors

@jaredwray made their first contribution in #64

Full Changelog: v3.0.4...v3.1.1

Does any of this look wrong? Please let us know.

↗️ flatted (indirect, 3.2.7 → 3.3.3) · Repo

Commits

See the full diff on Github. The new version differs by 31 commits:

↗️ ignore (indirect, 5.2.0 → 5.3.2) · Repo · Changelog

Release Notes

5.3.0

5.3.0

MINOR export Options interface (#105)

An upgrade is safe for all dependents

It allows typing external methods which expect Options as a param, by importing the Options interface.
import {Options} from 'ignore'

5.2.4

PATCH fixes normal single asterisk and normal consecutive asterisks defined in gitignore spec (#57)

PATCH invalid trailing backslash will not throw unexpectedly

An upgrade is recommended for all dependents

The following rules could be not properly parsed with previous ignore versions
**foo
*bar
qu*ux
abc\   # `ignore` would throw if no whitespace after `\`

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 38 commits:

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ punycode (indirect, 2.1.1 → 2.3.1) · Repo

Commits

See the full diff on Github. The new version differs by 25 commits:

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:

Reverts default value for options.indent to two spaces ' '.

Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed

Remove default indent by @mohd-akram in #24

🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41

🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33

chore: publish workflow by @OlafConijn in #42

New Contributors

@mohd-akram made their first contribution in #24

@OlafConijn made their first contribution in #41

@aashutoshrathi made their first contribution in #33

Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @eslint-community/eslint-utils (added, 4.9.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.1)

🆕 @eslint/config-helpers (added, 0.5.2)

🆕 @eslint/core (added, 1.1.0)

🆕 @eslint/object-schema (added, 3.0.1)

🆕 @eslint/plugin-kit (added, 0.6.0)

🆕 @humanfs/core (added, 0.19.1)

🆕 @humanfs/node (added, 0.16.7)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @isaacs/cliui (added, 9.0.0)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.8)

🆕 @types/json-schema (added, 7.0.15)

🆕 jackspeak (added, 4.2.3)

🆕 json-buffer (added, 3.0.1)

🆕 keyv (added, 4.5.4)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @nodelib/fs.scandir (removed)

🗑️ @nodelib/fs.stat (removed)

🗑️ @nodelib/fs.walk (removed)

🗑️ callsites (removed)

🗑️ chalk (removed)

🗑️ dir-glob (removed)

🗑️ doctrine (removed)

🗑️ eslint-config-airbnb-base (removed)

🗑️ eslint-utils (removed)

🗑️ fast-glob (removed)

🗑️ fastq (removed)

🗑️ globals (removed)

🗑️ globby (removed)

🗑️ grapheme-splitter (removed)

🗑️ has-flag (removed)

🗑️ import-fresh (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ merge2 (removed)

🗑️ parent-module (removed)

🗑️ path-type (removed)

🗑️ queue-microtask (removed)

🗑️ regexpp (removed)

🗑️ resolve-from (removed)

🗑️ reusify (removed)

🗑️ run-parallel (removed)

🗑️ slash (removed)

🗑️ strip-json-comments (removed)

🗑️ supports-color (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

depfu · 2026-03-06T22:45:29Z

Closed in favor of #50.

Update all of eslint to version 10.0.0

3e68c7e

depfu bot added the depfu label Feb 13, 2026

depfu bot had a problem deploying to production February 13, 2026 22:45 Failure

depfu bot closed this Mar 6, 2026

depfu bot deleted the depfu/update/npm/eslint-10.0.0 branch March 6, 2026 22:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] Update eslint 8.25.0 → 10.0.0 (major)#49

🚨 [security] Update eslint 8.25.0 → 10.0.0 (major)#49
depfu[bot] wants to merge 1 commit intomainfrom
depfu/update/npm/eslint-10.0.0

depfu bot commented Feb 13, 2026

Uh oh!

depfu bot commented Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

depfu bot commented Feb 13, 2026

What changed?

✳️ eslint (8.25.0 → 10.0.0) · Repo · Changelog

↗️ acorn (indirect, 8.8.0 → 8.15.0) · Repo

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

7.0.6 (from changelog)

Bug Fixes

7.0.5 (from changelog)

Bug Fixes

7.0.4 (from changelog)

Bug Fixes

↗️ eslint-scope (indirect, 7.1.1 → 9.1.0) · Repo · Changelog

8.0.2 (2024-07-08)

Bug Fixes

8.0.1 (2024-03-20)

Documentation

Chores

8.0.0 (2024-01-04)

⚠ BREAKING CHANGES

Features

Bug Fixes

Documentation

Chores

7.2.2 (2023-07-27)

Chores

7.2.1 (2023-05-31)

Chores

Features

Documentation

Build Related

Chores

↗️ eslint-visitor-keys (indirect, 3.3.0 → 5.0.0) · Repo · Changelog

4.0.0 (2024-02-08)

⚠ BREAKING CHANGES

Features

Chores

3.4.3 (2023-08-08)

Chores

3.4.2 (2023-07-27)

Documentation

Chores

3.4.1 (2023-05-05)

Bug Fixes

Chores

Features

Bug Fixes

Documentation

Build Related

Chores

↗️ espree (indirect, 9.4.0 → 11.1.0) · Repo · Changelog

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

↗️ file-entry-cache (indirect, 6.0.1 → 8.0.0) · Repo · Changelog

Removing support for Nodejs 10, 12, and 14

What's Changed

What's Changed

What's Changed

What's Changed

↗️ flat-cache (indirect, 3.0.4 → 4.0.1) · Repo · Changelog

What's Changed

New Contributors

Major version release

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

↗️ flatted (indirect, 3.2.7 → 3.3.3) · Repo

↗️ ignore (indirect, 5.2.0 → 5.3.2) · Repo · Changelog

5.3.0

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ punycode (indirect, 2.1.1 → 2.3.1) · Repo

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

What's Changed

New Contributors

🆕 @​eslint-community/eslint-utils (added, 4.9.1)

🆕 @​eslint-community/regexpp (added, 4.12.2)

🆕 @​eslint/config-array (added, 0.23.1)

🆕 @​eslint/config-helpers (added, 0.5.2)

🆕 @​eslint/core (added, 1.1.0)

🆕 @eslint-community/eslint-utils (added, 4.9.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.1)

🆕 @eslint/config-helpers (added, 0.5.2)

🆕 @eslint/core (added, 1.1.0)

🆕 @eslint/object-schema (added, 3.0.1)

🆕 @eslint/plugin-kit (added, 0.6.0)

🆕 @humanfs/core (added, 0.19.1)

🆕 @humanfs/node (added, 0.16.7)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @isaacs/cliui (added, 9.0.0)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.8)

🆕 @types/json-schema (added, 7.0.15)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @nodelib/fs.scandir (removed)

🗑️ @nodelib/fs.stat (removed)

🗑️ @nodelib/fs.walk (removed)