🚨 [security] Update eslint 8.57.0 → 10.0.2 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.57.0 → 10.0.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ acorn (indirect, 8.15.0 → 8.16.0) · Repo

Commits

See the full diff on Github. The new version differs by 22 commits:

• Mark version 8.16.0
• Mark acorn-walk 8.3.5
• Properly check for presence of node.attributes in walkers
• Bump test262
• Bump Unicode 17, regenerate script values
• Properly throw an error, not a raw string
• More explicit error when walking a tree and a node type isn't registered.
• Rename eslint config file to suppress warning
• Update to ESLint 9
• Add Unicode v17 support
• Use consistent semicolon-less style in readmes
• Docs: Announce both ESM and CommonJS imports are supported, change all examples to ESM imports
• Clean up identifier char handling in keyword lookahead functions
• Increase accuracy of isAsyncFunction when followed by a backslash
• Fix await using double lookahead edge case
• Mark acorn-loose 8.5.2
• Bump dependency on acorn in acorn-loose
• Add support for sourceType: commonjs option
• Reject return statement in static block, even if allowReturnOutsideFunction is used
• Reject using declarations directly in for loop or switch scopes.
• Improve lookahead test for using syntax
• Mark acorn-loose 8.5.1

↗️ ajv (indirect, 6.12.6 → 6.14.0) · Repo

Security Advisories 🚨

🚨 ajv has ReDoS when using `$data` option

ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

Commits

See the full diff on Github. The new version differs by 7 commits:

• 6.14.0
• add regExp option to address $data exploit via a regular expression (CVE-2025-69873) (#2590)
• docs: update v7 info
• Merge pull request #1320 from philsturgeon/patch-1
• Add spectral, an AJV util from a sponsor
• docs: v7.0.0-beta.3
• update readme for v7

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes

• update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes

• fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes

• disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

• chore(release): 7.0.6
• chore: upgrade standard-version
• fix: update cross-spawn version to 7.0.5 in package-lock.json
• chore: fix build status badge
• chore(release): 7.0.5
• fix: fix escaping bug introduced by backtracking
• chore: remove codecov
• chore: replace travis with github workflows
• chore(release): 7.0.4
• fix: disable regexp backtracking (#160)
• chore: fix tests in recent node js versions
• chore: convert package lock
• chore: remove unused argument (#156)
• chore: add travis jobs on ppc64le (#142)
• chore: fix audit warning

↗️ eslint-scope (indirect, 7.2.2 → 9.1.1) · Repo · Changelog

Release Notes

9.1.1 (from changelog)

Dependencies

• The following workspace dependencies were updated
  • devDependencies
    • eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
    • espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)

Bug Fixes

• Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)

Documentation

• document Security Policy (#122) (0d03700)

Chores

• switch to eslint flat config (#121) (59b1606)
• upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)

⚠ BREAKING CHANGES

• use ESTree directive property when searching for "use strict" (#118)
• class extends is evaluated in the class scope (#116)
• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
• use ESTree directive property when searching for "use strict" (#118) (23fe81f)

Bug Fixes

• class extends is evaluated in the class scope (#116) (42ef7a9)

Documentation

• Update README with analyze() options (#111) (2122fdb), closes #110

Chores

• Remove add-to-triage (#106) (dc75851)
• run tests in Node.js 21 (#109) (957748e)
• standardize npm script names (#105) (115ded3)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.6.1 → 11.1.1) · Repo · Changelog

Release Notes

11.1.1 (from changelog)

Bug Fixes

• improve tree-shaking (#725) (b699f32)
• update acorn, fix tests (#731) (883d4cc)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1

11.1.0 (from changelog)

Features

• add types to ESLint Scope (#709) (98caac0)
• TypeScript support for Espree (#705) (5887c4d)

Bug Fixes

• restore comments property on tokenize() return value (#721) (5603ea9)

11.0.0 (from changelog)

⚠ BREAKING CHANGES

• Program range span entire source text (#677)
• Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#696)

Features

• Program range span entire source text (#677) (68bbb74)
• Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#696) (9c84ecb)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.2.1 to ^5.0.0

10.4.0 (from changelog)

Features

• Add support for ES2026 using and await using declarations (#658) (39e0865)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.2.0 to ^4.2.1

10.3.0 (from changelog)

Features

• add support for Import Attributes and RegExp Modifiers (#639) (2fd4222)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.1.0 to ^4.2.0

10.2.0 (from changelog)

Features

• add the eslint-scope package (#615) (2ecfb8b)

Bug Fixes

• Update dependencies to avoid build failure (#631) (e8cd107)
• update links to eslint/js repo (#619) (956389a)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.0.0 to ^4.1.0

10.1.0

10.1.0 (2024-06-17)

Features

• Support ES2025 and RegExp duplicate named capturing groups (#608) (3059713)

10.0.1

10.0.1 (2024-02-09)

Chores

• upgrade eslint-visitor-keys@4.0.0 (#595) (6254a91)

10.0.0

10.0.0 (2024-01-25)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#589)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#589) (e79cfa4)

Bug Fixes

• upgrade acorn v8.11.3 (#590) (6d30382)

Chores

• Add PRs to triage project (#580) (086555e)
• Remove add-to-triage (#583) (3907385)
• run tests in Node.js 21 (#585) (1584ddb)
• standardize npm script names (#582) (b0767ef)
• use eslint-config-eslint@9.0.0 (#584) (ec949bc)

Does any of this look wrong? Please let us know.

↗️ esquery (indirect, 1.5.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ file-entry-cache (indirect, 6.0.1 → 8.0.0) · Repo · Changelog

Release Notes

8.0.0

Removing support for Nodejs 10, 12, and 14

This is updating modules to the latest versions and supporting Nodejs >=16 moving forward with v8.0.0

What's Changed

• removing support for nodejs 12 and 14 by @jaredwray in #43

Full Changelog: v7.0.2...v8.0.0

7.0.2

What's Changed

• removing del module as no longer needed by @jaredwray in #40
• upgrading flat-cache to 3.2.0 by @jaredwray in #41

Full Changelog: v7.0.1...v7.0.2

7.0.1

What's Changed

• upgrading flat-cache to 3.1.1 by @jaredwray in #37
• upgrading chai to 4.3.10 by @jaredwray in #38
• upgrading eslint to 8.50.0 and mocha plugin by @jaredwray in #39

Full Changelog: v7.0.0...v7.0.1

7.0.0

What's Changed

• upgrading chai and mocha to latest by @jaredwray in #32
• removing package-lock and setting tests to nodejs versions by @jaredwray in #33
• adding code coverage reporting via codecov by @jaredwray in #34
• updating tests for master by @jaredwray in #35
• removing support for Nodejs version 10 by @jaredwray in #36

Full Changelog: v6.0.1...v7.0.0

Does any of this look wrong? Please let us know.

↗️ flat-cache (indirect, 3.2.0 → 4.0.1) · Repo · Changelog

Release Notes

4.0.1

What's Changed

• removing rimraf as core dependency by @jaredwray in #87
• chore: run prettier separately from eslint by @uncenter in #88
• refactor: prefer let/const over var by @uncenter in #89
• upgrading c8 to 9.1.0 by @jaredwray in #92
• upgrading prettier to 3.2.4 by @jaredwray in #93
• upgrading moch to 10.3.0 by @jaredwray in #95
• removing parts of keyv as a dependency by @jaredwray in #97

New Contributors

• @uncenter made their first contribution in #88

Full Changelog: v4.0.0...v4.0.1

4.0.0

Major version release

To stay up to date with latest module dependencies we moved to supporting nodejs >=16 with this release. All other functionality stayed the same.

What's Changed

• removing the testing on 21 by @jaredwray in #85
• removing support for node 10, 12, and 14 by @jaredwray in #86

Full Changelog: v3.2.0...v4.0.0

Does any of this look wrong? Please let us know.

🆕 @​eslint/config-array (added, 0.23.2)

🆕 @​eslint/config-helpers (added, 0.5.2)

🆕 @​eslint/core (added, 1.1.0)

🆕 @​eslint/object-schema (added, 3.0.2)

🆕 @​eslint/plugin-kit (added, 0.6.0)

🆕 @​humanfs/core (added, 0.19.1)

🆕 @​humanfs/node (added, 0.16.7)

🆕 @​humanwhocodes/retry (added, 0.4.3)

🆕 @​types/esrecurse (added, 4.3.1)

🆕 minimatch (added, 10.2.2)

🆕 eslint-visitor-keys (added, 5.0.1)

🆕 brace-expansion (added, 5.0.3)

🆕 balanced-match (added, 4.0.4)

🗑️ @​eslint/eslintrc (removed)

🗑️ @​eslint/js (removed)

🗑️ @​humanwhocodes/config-array (removed)

🗑️ @​humanwhocodes/object-schema (removed)

🗑️ @​ungap/structured-clone (removed)

🗑️ lodash.merge (removed)

🗑️ text-table (removed)

🗑️ globals (removed)

🗑️ type-fest (removed)

🗑️ doctrine (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Closed in favor of #304.