🚨 [security] Update eslint 8.25.0 → 10.0.2 (major)

[depfu]

---

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

---

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.25.0 → 10.0.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ acorn (indirect, 8.8.0 → 8.16.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.14.0) · Repo

Security Advisories 🚨

🚨 ajv has ReDoS when using `$data` option

ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

Commits

See the full diff on Github. The new version differs by 7 commits:

• 6.14.0
• add regExp option to address $data exploit via a regular expression (CVE-2025-69873) (#2590)
• docs: update v7 info
• Merge pull request #1320 from philsturgeon/patch-1
• Add spectral, an AJV util from a sponsor
• docs: v7.0.0-beta.3
• update readme for v7

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes

• update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes

• fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes

• disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

• chore(release): 7.0.6
• chore: upgrade standard-version
• fix: update cross-spawn version to 7.0.5 in package-lock.json
• chore: fix build status badge
• chore(release): 7.0.5
• fix: fix escaping bug introduced by backtracking
• chore: remove codecov
• chore: replace travis with github workflows
• chore(release): 7.0.4
• fix: disable regexp backtracking (#160)
• chore: fix tests in recent node js versions
• chore: convert package lock
• chore: remove unused argument (#156)
• chore: add travis jobs on ppc64le (#142)
• chore: fix audit warning

↗️ eslint-scope (indirect, 7.1.1 → 9.1.2) · Repo · Changelog

↗️ eslint-visitor-keys (indirect, 3.3.0 → 5.0.1) · Repo · Changelog

Release Notes

5.0.1

• c40e2fc Upgrade: acorn@6.0.7 (#407) (Kai Cataldo)

4.0.0

4.0.0 (2024-02-08)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#63)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#63) (388b2ac)

Chores

• run tests in Node.js 21 (#61) (b23bfb7)

3.4.3

3.4.3 (2023-08-08)

Chores

• Add back add-to-triage (#59) (5ea8b12)
• Remove add-to-triage (#56) (45d4c17)
• standardize npm script names (#55) (0461695)
• update typedef in build keys template (#58) (eb6c66d)

3.4.2

3.4.2 (2023-07-27)

Documentation

• fix spelling mistakes (#50) (4ce1c17)
• remove release script reference from README (#52) (4640146)

Chores

• Add PRs to triage (#54) (a7b64b4)
• generate provenance statements when release (#53) (7b09698)

3.4.1

3.4.1 (2023-05-05)

Bug Fixes

• correct types for node16 resolution (#47) (7bd1fc1)

Chores

• run tests on Node.js v20 (#45) (c982093)
• set up release-please (#48) (a7fb4c7)

3.4.0

Features

• 6ece4bd feat: add JSXSpreadChild and tool to build keys out of AST definitions (#36) (Brett Zamir)

Bug Fixes

• e9a070f fix: remove useless sourcemap url (fixes #43) (#44) (余腾靖)

Documentation

• 4beb7a7 docs: update badges (#37) (Milos Djermanovic)

Build Related

• 81c0732 build: add node v18 (#39) (唯然)

Chores

• 0398109 chore: add triage action (#42) (Milos Djermanovic)
• bcffbe5 ci: add Node v19 (#41) (Milos Djermanovic)
• c24f2e4 chore: update github actions and add funding field (#40) (Deepshika S)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ espree (indirect, 9.4.0 → 11.2.0) · Repo · Changelog

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ file-entry-cache (indirect, 6.0.1 → 8.0.0) · Repo · Changelog

Release Notes

8.0.0

Removing support for Nodejs 10, 12, and 14

This is updating modules to the latest versions and supporting Nodejs >=16 moving forward with v8.0.0

What's Changed

• removing support for nodejs 12 and 14 by @jaredwray in #43

Full Changelog: v7.0.2...v8.0.0

7.0.2

What's Changed

• removing del module as no longer needed by @jaredwray in #40
• upgrading flat-cache to 3.2.0 by @jaredwray in #41

Full Changelog: v7.0.1...v7.0.2

7.0.1

What's Changed

• upgrading flat-cache to 3.1.1 by @jaredwray in #37
• upgrading chai to 4.3.10 by @jaredwray in #38
• upgrading eslint to 8.50.0 and mocha plugin by @jaredwray in #39

Full Changelog: v7.0.0...v7.0.1

7.0.0

What's Changed

• upgrading chai and mocha to latest by @jaredwray in #32
• removing package-lock and setting tests to nodejs versions by @jaredwray in #33
• adding code coverage reporting via codecov by @jaredwray in #34
• updating tests for master by @jaredwray in #35
• removing support for Nodejs version 10 by @jaredwray in #36

Full Changelog: v6.0.1...v7.0.0

Does any of this look wrong? Please let us know.

↗️ flat-cache (indirect, 3.0.4 → 4.0.1) · Repo · Changelog

Release Notes

4.0.1

What's Changed

• removing rimraf as core dependency by @jaredwray in #87
• chore: run prettier separately from eslint by @uncenter in #88
• refactor: prefer let/const over var by @uncenter in #89
• upgrading c8 to 9.1.0 by @jaredwray in #92
• upgrading prettier to 3.2.4 by @jaredwray in #93
• upgrading moch to 10.3.0 by @jaredwray in #95
• removing parts of keyv as a dependency by @jaredwray in #97

New Contributors

• @uncenter made their first contribution in #88

Full Changelog: v4.0.0...v4.0.1

4.0.0

Major version release

To stay up to date with latest module dependencies we moved to supporting nodejs >=16 with this release. All other functionality stayed the same.

What's Changed

• removing the testing on 21 by @jaredwray in #85
• removing support for node 10, 12, and 14 by @jaredwray in #86

Full Changelog: v3.2.0...v4.0.0

3.2.0

What's Changed

• [Fix] restore node 10 compat by @ljharb in #81

New Contributors

• @ljharb made their first contribution in #81

Full Changelog: v3.1.1...v3.2.0

3.1.1

What's Changed

• updating repo to use github actions and codecov by @jaredwray in #64
• updating mocha and chai by @jaredwray in #65
• adding in codecov badge by @jaredwray in #66
• upgrading flatted to 3.2.7 by @jaredwray in #67
• updating workflows with prs by @jaredwray in #71
• updating coverage reporting to work with codecov by @jaredwray in #72
• updating to show correct branch by @jaredwray in #73
• intoducing keyv to flat-cache - non invasive by @jaredwray in #74
• clean up of package.json by @jaredwray in #75
• upgrading chai to 4.3.10 by @jaredwray in #77
• upgrading flatted to 3.2.9 by @jaredwray in #78

New Contributors

• @jaredwray made their first contribution in #64

Full Changelog: v3.0.4...v3.1.1

Does any of this look wrong? Please let us know.

↗️ flatted (indirect, 3.2.7 → 3.3.4) · Repo

Commits

See the full diff on Github. The new version differs by 48 commits:

• 3.3.4
• added golang/pkg/flatted/flatted.go as part of the published package
• Merge pull request #85 from egandro/golang-port
• removed uses
• directory fix
• linter fix
• 1.26.0
• sudo
• added --sort keys
• added main
• ci fix
• ci cd
• initial import
• removed Travis badge as irrelevant
• Merge pull request #84 from WebReflection/workflows-v4
• when in Rome
• Updated GitHub workflows
• 3.3.3
• ruf/linted Python + dev-dependencies updates
• explicit files in package.json
• 3.3.2
• Fix #81 - Removed published __pycache__ from npm
• 3.3.1
• Fixed another typo on TS definition
• 3.3.0
• Fixed types and TS logo in npm
• Removed jsr.json from npm
• 3.2.13
• Fixed typo in JSDoc TS
• 3.2.12
• Last attempt to fix jsr.io
• Still trying to fix jsr.io publishing
• 3.2.11
• Improved TS types
• Bumped jsr.io too
• 3.2.10
• Trying this jsr thing
• Updated dev-dependencies
• Updated all dev/dependencies
• Merge pull request #71 from WebReflection/python
• 3.2.9
• Added Python version of the very same thing
• 3.2.8
• Merge pull request #70 from WebReflection/issue-69
• Fix #69 - Make `$value` an explicit class field
• Removed a disturbingly unnecessary early return
• Merge pull request #63 from WebReflection/dependabot/npm_and_yarn/json5-2.2.3
• Bump json5 from 2.2.1 to 2.2.3

↗️ ignore (indirect, 5.2.0 → 5.3.2) · Repo · Changelog

Release Notes

5.3.0

5.3.0

• MINOR export Options interface (#105)

An upgrade is safe for all dependents

---

It allows typing external methods which expect Options as a param, by importing the Options interface.

import {Options} from 'ignore'

5.2.4

• PATCH fixes normal single asterisk and normal consecutive asterisks defined in gitignore spec (#57)
• PATCH invalid trailing backslash will not throw unexpectedly

An upgrade is recommended for all dependents

---

The following rules could be not properly parsed with previous ignore versions

**foo
*bar
qu*ux
abc\   # `ignore` would throw if no whitespace after `\`

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 38 commits:

• 5.3.2: fixes #130, fixes consequent escaped backslashes
• Merge pull request #128 from kaelzhang/dependabot/npm_and_yarn/rimraf-6.0.1
• dependabot.yml: ignore eslint
• Bump rimraf from 5.0.9 to 6.0.1
• dependabot: ignore tap
• Merge pull request #110 from kaelzhang/dependabot/npm_and_yarn/tmp-0.2.3
• Bump tmp from 0.2.1 to 0.2.3
• 5.3.1: #108: remove BOM before processing .gitignore rules
• 5.3.0: #105
• Merge pull request #105 from DamianGlowala/patch-1
• Update index.d.ts
• test: rollback tap for the breaking change
• Merge pull request #103 from kaelzhang/dependabot/npm_and_yarn/tap-18.5.3
• Bump tap from 16.3.9 to 18.5.3
• test/typescript: add more tests for interface Ignore
• chore: upgrade dev deps
• #94: upgrade mkdirp -> 3.0.0
• Merge pull request #93 from kaelzhang/dependabot/npm_and_yarn/rimraf-5.0.0
• Bump rimraf from 4.4.1 to 5.0.0
• Merge pull request #92 from kaelzhang/dependabot/npm_and_yarn/typescript-5.0.2
• Bump typescript from 4.9.5 to 5.0.2
• test: update git actions: since ignore are node-version-agnostic, so only test on node LTS
• test: since ignore are node-version-agnostic, so only test on node LTS
• chore: upgrade dev dependencies, fixes #85, fixes #89, fixes #86
• Create dependabot.yml
• 5.2.4: README: update github action badge
• test/coverage: do not force test coverage on windows since it is quite hard to ignore different lines for linux and windows
• test/coverage: remove the buggy "istanbul ignore next" (nyc @15.1.0)
• test: another test cases related to #57
• dev: upgrade dev dependencies
• test: remove timeout setting for git-check-ignore
• 5.2.3: fixes #57: fixes normal single / consecutive asterisks
• #57: test: support test.only
• #81: fixes windows test cases
• #81: fixes windows test cases
• 5.2.2: fixes #81: invalid single trailing backslash should not throw
• 5.2.1: fixes typo in the example of "backslash hash", related to #83
• #76: add test case

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ punycode (indirect, 2.1.1 → 2.3.1) · Repo

Commits

See the full diff on Github. The new version differs by 25 commits:

• Release v2.3.1
• Prepare v2.3.1 release
• Update `version`
• ci(deps): update GitHub Actions workflows to run on Node.js 20 (LTS) (#130)
• Update dependencies (#128)
• Fix broken reference
• Add README section for maintainers
• Release v2.3.0
• Rename package.json#name before publishing `punycode.js`
• Release v2.2.2
• Update repo URL
• Add jsDelivr hits badge (#69)
• Update mocha dependency (#103)
• Set up GitHub Actions
• Add test for #115
• Do not encode DEL (#115)
• Update browser support section in README (#118)
• Replace `let` with `const` where applicable (#93)
• Release v2.2.1
• Do not decode non-ASCII-alphanumerics in Punycode labels (#124)
• Release v2.2.0
• fix: upstream node.js changes (#121)
• fix: update jsdoc definitions (#120)
• Fix usage instructions in README (#113)
• Add LTS Node.js version to CI settings (#92)

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:

Reverts default value for options.indent to two spaces ' '.

Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed

• Remove default indent by @mohd-akram in #24
• 🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
• 🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
• chore: publish workflow by @OlafConijn in #42

New Contributors

• @mohd-akram made their first contribution in #24
• @OlafConijn made their first contribution in #41
• @aashutoshrathi made their first contribution in #33

Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

• 1.2.5
• revert default indent
• run verb to generate README
• Merge pull request #42 from jonschlinkert/chore/publish-workflow
• Merge pull request #41 from jonschlinkert/fix/CVE-2023-26115-2
• Update .github/workflows/publish.yml
• chore: bump version to 1.2.4
• chore: add publish workflow
• chore: fix test
• chore: remove package-lock
• chore: added an additional testcase
• fix: cve 2023-26115
• fix: settle for new regex to support lower node versions
• :lock: fix: CVE-2023-26115
• Merge pull request #24 from mohd-akram/remove-default-indent
• Remove default indent

🆕 @​eslint-community/eslint-utils (added, 4.9.1)

🆕 @​eslint-community/regexpp (added, 4.12.2)

🆕 @​eslint/config-array (added, 0.23.3)

🆕 @​eslint/config-helpers (added, 0.5.3)

🆕 @​eslint/core (added, 1.1.1)

🆕 @​eslint/object-schema (added, 3.0.3)

🆕 @​eslint/plugin-kit (added, 0.6.1)

🆕 @​humanfs/core (added, 0.19.1)

🆕 @​humanfs/node (added, 0.16.7)

🆕 @​humanwhocodes/retry (added, 0.4.3)

🆕 @​types/esrecurse (added, 4.3.1)

🆕 @​types/estree (added, 1.0.8)

🆕 @​types/json-schema (added, 7.0.15)

🆕 json-buffer (added, 3.0.1)

🆕 keyv (added, 4.5.4)

🗑️ @​eslint/eslintrc (removed)

🗑️ @​humanwhocodes/config-array (removed)

🗑️ @​humanwhocodes/object-schema (removed)

🗑️ @​nodelib/fs.scandir (removed)

🗑️ @​nodelib/fs.stat (removed)

🗑️ @​nodelib/fs.walk (removed)

🗑️ callsites (removed)

🗑️ chalk (removed)

🗑️ dir-glob (removed)

🗑️ doctrine (removed)

🗑️ eslint-config-airbnb-base (removed)

🗑️ eslint-utils (removed)

🗑️ fast-glob (removed)

🗑️ fastq (removed)

🗑️ globals (removed)

🗑️ globby (removed)

🗑️ grapheme-splitter (removed)

🗑️ has-flag (removed)

🗑️ import-fresh (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ merge2 (removed)

🗑️ parent-module (removed)

🗑️ path-type (removed)

🗑️ queue-microtask (removed)

🗑️ regexpp (removed)

🗑️ resolve-from (removed)

🗑️ reusify (removed)

🗑️ run-parallel (removed)

🗑️ slash (removed)

🗑️ strip-json-comments (removed)

🗑️ supports-color (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Closed in favor of #51.