Skip to content

🚨 [security] Update eslint 8.32.0 → 10.8.0 (major) - #254

Open
depfu[bot] wants to merge 1 commit into
masterfrom
depfu/update/npm/eslint-10.8.0
Open

🚨 [security] Update eslint 8.32.0 → 10.8.0 (major)#254
depfu[bot] wants to merge 1 commit into
masterfrom
depfu/update/npm/eslint-10.8.0

Conversation

@depfu

@depfu depfu Bot commented Jul 31, 2026

Copy link
Copy Markdown

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.32.0 → 10.8.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 39 commits:

↗️ @​types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @​types/semver (indirect, 7.3.13 → 7.7.1) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes

  • update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes

  • fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

Release Notes

9.1.2 (from changelog)

Dependencies

  • The following workspace dependencies were updated
    • devDependencies
      • espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (from changelog)

Dependencies

  • The following workspace dependencies were updated
    • devDependencies
      • eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
      • espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)

Bug Fixes

  • Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)

Documentation

Chores

  • switch to eslint flat config (#121) (59b1606)
  • upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)

⚠ BREAKING CHANGES

  • use ESTree directive property when searching for "use strict" (#118)
  • class extends is evaluated in the class scope (#116)
  • Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)

Features

  • Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
  • use ESTree directive property when searching for "use strict" (#118) (23fe81f)

Bug Fixes

  • class extends is evaluated in the class scope (#116) (42ef7a9)

Documentation

Chores

7.2.2

7.2.2 (2023-07-27)

Chores

7.2.1

7.2.1 (2023-05-31)

Chores

7.2.0

Features

  • 70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)

Documentation

  • 25abacf docs: add badges (#89) (Milos Djermanovic)

Build Related

Chores

  • 3dbad80 chore: add triage action (#95) (Milos Djermanovic)
  • 34ffedc ci: add Node v19 (#94) (Milos Djermanovic)
  • 4c00534 ci: update Github actions (#93) (Deepshika S)
  • 6c8ccf2 chore: add funding field (#92) (Deepshika S)

7.1.1

Bug Fixes

  • 4e1d24c fix: ignore "use strict" directives in ES3 (#87) (Milos Djermanovic)

Chores

  • 8938109 chore: upgrade espree@9.3.1 eslint-visitor-keys@3.3.0 (#88) (Milos Djermanovic)
  • ceb8bdd ci: use node v16 (#84) (Nitin Kumar)
  • 62e147b test: add tests with year-based ecmaVersion (#83) (Milos Djermanovic)

7.1.0

Features

  • d756f1e feat: Add sourceType:commonjs support (#81) (Nicholas C. Zakas)

7.0.0

Breaking Changes

  • 22a55c0 feat!: support class static blocks (#80) (Milos Djermanovic)

Build Related

  • 4aafb61 build: upgrade eslint-release to v3.2.0 to support conventional commits (#79) (Milos Djermanovic)
  • 263c762 Build: add node v17 (#76) (唯然)

6.0.0

  • 4ee1d80 Fix: Ensure correct version in package (#73) (Nicholas C. Zakas)
  • 82a7e6d Breaking: Switch to ESM (fixes #70) (#71) (Brett Zamir)
  • 0b4a5f1 Update: support class fields (refs eslint/eslint#14343) (#69) (Toru Nagashima)
  • 39f8cfc Chore: upgrade estraverse to version 5 (#68) (Rouven Weßling)
  • ae27ff3 Docs: Add range to espree options in README (fixes #66) (#67) (Alan Liang)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

Summary

The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.

Root Cause

File: esm/index.js:29 (identical in cjs/index.js)

  const resolver = (input, lazy, parsed, $) => output => {
    for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
      const k = ke[y];
      const value = output[k];    
      if (value instanceof Primitive) {
        const tmp = input[value];      // Bug is here

No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:

  • has type "object" → passes the typeof tmp === object guard at line 30
  • is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
  • The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.

Replication Steps

  const Flatted = require('flatted'); 
  const parsed = Flatted.parse('[{"x":"__proto__"}]');
  parsed.x.polluted = 'pwned';
  console.log([].polluted);  // Returns true

Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.

Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:

// Before (vulnerable)
const tmp = input[value];

// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Summary

flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.

Impact

Denial of Service (DoS). Any application that passes untrusted input to flatted.parse() can be crashed by an unauthenticated attacker with a single request.

flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.

Proof of Concept

const flatted = require('flatted');

// Build deeply nested circular reference chain

const depth = 20000;

const arr = new Array(depth + 1);

arr[0] = '{"a":"1"}';

for (let i = 1; i <= depth; i++) {

arr[i] = {"a":"<span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">i</span> <span class="pl-c1">+</span> <span class="pl-c1">1</span><span class="pl-kos">}</span></span>"};

}

arr[depth] = '{"a":"leaf"}';


const payload = JSON.stringify(arr);

flatted.parse(payload); // RangeError: Maximum call stack size exceeded

Fix

The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive revive() to a stack-based loop.

Affected Versions

All versions prior to the PR #88 fix.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:

Reverts default value for options.indent to two spaces ' '.

Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed

New Contributors

Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @​eslint-community/eslint-utils (added, 4.10.1)

🆕 @​eslint-community/regexpp (added, 4.12.2)

🆕 @​eslint/config-array (added, 0.23.5)

🆕 @​eslint/config-helpers (added, 0.7.0)

🆕 @​eslint/core (added, 1.2.1)

🆕 @​eslint/object-schema (added, 3.0.5)

🆕 @​eslint/plugin-kit (added, 0.7.2)

🆕 @​humanfs/core (added, 0.19.2)

🆕 @​humanfs/node (added, 0.16.8)

🆕 @​humanfs/types (added, 0.15.0)

🆕 @​humanwhocodes/retry (added, 0.4.3)

🆕 @​types/esrecurse (added, 4.3.1)

🆕 @​types/estree (added, 1.0.9)

🗑️ @​eslint/eslintrc (removed)

🗑️ @​humanwhocodes/config-array (removed)

🗑️ @​humanwhocodes/object-schema (removed)

🗑️ @​types/json-buffer (removed)

🗑️ @​typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

🗑️ grapheme-splitter (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ strip-json-comments (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added the depfu label Jul 31, 2026
@changeset-bot

changeset-bot Bot commented Jul 31, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 4cbe0ae

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@depfu depfu Bot mentioned this pull request Jul 31, 2026
Closed
@socket-security

socket-security Bot commented Jul 31, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​eslint@​8.32.0 ⏵ 10.8.097 +110010095 +45100

View full report

@mergify

mergify Bot commented Jul 31, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants