🚨 [security] Update eslint 8.57.1 → 9.39.1 (major)

[depfu[bot]]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.57.1 → 9.39.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​eslint/eslintrc (indirect, 2.1.4 → 3.3.1) · Repo · Changelog

Release Notes

3.3.1

3.3.1 (2025-03-11)

Bug Fixes

• correct types field in package.json (#184) (2f4cf3f)

3.3.0

3.3.0 (2025-02-21)

Features

• Add types to package (#179) (cb546be)

3.2.0

3.2.0 (2024-11-14)

Features

• merge rule.meta.defaultOptions before validation (#166) (d02f914)

3.1.0

3.1.0 (2024-05-17)

Features

• Expose loadConfigFile() function (#160) (59e890f)

Chores

• run tests in Node.js 22 (#154) (5e526f2)
• update dependency shelljs to ^0.8.5 (#156) (903b887)

3.0.2

3.0.2 (2024-02-12)

Chores

• maintenance update of globals to v14 (#152) (4151865)

3.0.1

3.0.1 (2024-02-09)

Documentation

• fix changelog for v3.0.0 (#144) (a613847)
• More explicit about all and recommended configs (#150) (0fabc74)

Chores

• upgrade [email protected] (#151) (8c39944)

3.0.0

3.0.0 (2023-12-27)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#142)
• Set default schema: [], drop support for function-style rules (#139)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#142) (737eb25)
• Set default schema: [], drop support for function-style rules (#139) (a6c240d)

Chores

• upgrade github actions (#143) (de34faf)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 25 commits:

• chore: release 3.3.1 (#185)
• docs: update readme to include bun install (#182)
• fix: correct `types` field in package.json (#184)
• chore: release 3.3.0 (#181)
• feat: Add types to package (#179)
• refactor: Upgrade ESLint (#178)
• chore: release 3.2.0 (#174)
• feat: merge rule.meta.defaultOptions before validation (#166)
• docs: add `compat.extends` example with plugin config (#173)
• ci: run tests in Node.js 23 (#170)
• ci: reduce list of releasable tags to `feat`, `fix` and `perf` (#161)
• chore: release 3.1.0 (#155)
• feat: Expose loadConfigFile() function (#160)
• chore: update dependency shelljs to ^0.8.5 (#156)
• ci: run tests in Node.js 22 (#154)
• chore: release 3.0.2 (#153)
• chore: maintenance update of `globals` to `v14` (#152)
• chore: release 3.0.1 (#145)
• chore: upgrade [email protected] (#151)
• docs: More explicit about all and recommended configs (#150)
• docs: fix changelog for v3.0.0 (#144)
• chore: release 3.0.0 (#141)
• chore: upgrade github actions (#143)
• feat!: Require Node.js `^18.18.0 || ^20.9.0 || >=21.1.0` (#142)
• feat!: Set default `schema: []`, drop support for function-style rules (#139)

↗️ @​eslint/js (indirect, 8.57.1 → 9.39.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ acorn (indirect, 8.11.2 → 8.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 70 commits:

• Mark version 8.15.0
• Make linter happy
• Fix a crash when running the CLI tool on code with a bigint
• Fix the format of bigint property on bigint literal
• Show logo in readme.md
• Add support for using and await using
• Bump test262
• Make sure the loose parser skips number literals with invalid separators
• Remove outdated comment
• Remove trailing whitespace, semicolon
• Define a NodeTypes record that plugins can extend to add nodes to AnyNode
• Switch some types on walk.d.ts from Node to AnyNode
• Add a package lock file
• fix(ci): run in correct branch
• setup(ci): consolidate
• Mark acorn-loose 8.5.0
• Mark version 8.14.1
• Make sure `ExportNamedDeclaration` nodes always have an `attributes` property
• Consistent field order in `Property` in tests
• Consistent field order in `Property`
• Include file name in `SyntaxError` message if present
• Remove empty @param declarations from acorn-walk type declarations
• Allow null in types of optional params to findNodeAt and findNodeAround
• Change approach to field init scope tracking
• Further refine handling of await in class fields
• Make sure await in class field initializers is checked properly
• Mark version 8.14.0
• Add missing unicode properties
• Add support for ES2025 RegExp Modifiers
• Add support for ES2025 Import Attributes
• Mark version 8.13.0
• Remove unused eslint-plugin-promise package
• Add Unicode v16 support
• Fix whitelist, unsupported features
• Bump test262
• Mark acorn-walk version 8.3.4
• Walk SwitchCase nodes as separate nodes in the base walker for SwitchStatement
• Mark version 8.12.1
• Don't use an /s regexp
• Simplify imports
• Bump actions/setup-node v4
• Bump test262
• Mark acorn-walk version 8.3.3
• Mark version 8.12.0
• Specify a direct dependency on acorn in acorn-walk
• Add VariableDeclarator to AnyNode type
• Actually initialize branchID in RegExpValidationState constuctor
• refactor to remove unnecessary code
• Add 2025 to ecmaVersion type
• Allow duplicate regexp capture group names in different branches
• Fix parsing of an "async of" edge case in for loop (#1286)
• Properly handle line breaks when looking for directives (#1283)
• Mark Parser constructor as protected so plugins can extend it
• Fix minor ParenthesizedExpression-related issues (#1277)
• Fix minor line terminator/line number tracking issues
• Properly account for crlf line breaks in readInvalidTemplateToken
• Properly tack line numbers in readInvalidTemplateToken
• Add missing changelog entry
• Mark acorn-walk 8.3.2
• Delete trailing whitespace
• Export type for findNodeBefore
• Adjust package.json
• Mark version 8.11.3
• Fix assignment of loc.start for new.target and import.meta
• Mark acorn-walk 8.3.1
• changed eslint-plugin-node package with eslint-plugin-n
• Make visitors keep their "this" context
• Remove old 'Mozilla Parser API' terminology
• Don't overwrite node type when parsing import.meta
• Add Function and Class to AggregateType

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes

• update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes

• fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes

• disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

• chore(release): 7.0.6
• chore: upgrade standard-version
• fix: update cross-spawn version to 7.0.5 in package-lock.json
• chore: fix build status badge
• chore(release): 7.0.5
• fix: fix escaping bug introduced by backtracking
• chore: remove codecov
• chore: replace travis with github workflows
• chore(release): 7.0.4
• fix: disable regexp backtracking (#160)
• chore: fix tests in recent node js versions
• chore: convert package lock
• chore: remove unused argument (#156)
• chore: add travis jobs on ppc64le (#142)
• chore: fix audit warning

↗️ eslint-scope (indirect, 7.2.2 → 8.4.0) · Repo · Changelog

Release Notes

8.0.2

8.0.2 (2024-07-08)

Bug Fixes

• Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)

Documentation

• document Security Policy (#122) (0d03700)

Chores

• switch to eslint flat config (#121) (59b1606)
• upgrade [email protected], [email protected] (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)

⚠ BREAKING CHANGES

• use ESTree directive property when searching for "use strict" (#118)
• class extends is evaluated in the class scope (#116)
• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
• use ESTree directive property when searching for "use strict" (#118) (23fe81f)

Bug Fixes

• class extends is evaluated in the class scope (#116) (42ef7a9)

Documentation

• Update README with analyze() options (#111) (2122fdb), closes #110

Chores

• Remove add-to-triage (#106) (dc75851)
• run tests in Node.js 21 (#109) (957748e)
• standardize npm script names (#105) (115ded3)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.6.1 → 10.4.0) · Repo · Changelog

Release Notes

10.4.0 (from changelog)

Features

• Add support for ES2026 using and await using declarations (#658) (39e0865)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.2.0 to ^4.2.1

10.3.0 (from changelog)

Features

• add support for Import Attributes and RegExp Modifiers (#639) (2fd4222)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.1.0 to ^4.2.0

10.2.0 (from changelog)

Features

• add the eslint-scope package (#615) (2ecfb8b)

Bug Fixes

• Update dependencies to avoid build failure (#631) (e8cd107)
• update links to eslint/js repo (#619) (956389a)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.0.0 to ^4.1.0

10.1.0

10.1.0 (2024-06-17)

Features

• Support ES2025 and RegExp duplicate named capturing groups (#608) (3059713)

10.0.1

10.0.1 (2024-02-09)

Chores

• upgrade [email protected] (#595) (6254a91)

10.0.0

10.0.0 (2024-01-25)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#589)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#589) (e79cfa4)

Bug Fixes

• upgrade acorn v8.11.3 (#590) (6d30382)

Chores

• Add PRs to triage project (#580) (086555e)
• Remove add-to-triage (#583) (3907385)
• run tests in Node.js 21 (#585) (1584ddb)
• standardize npm script names (#582) (b0767ef)
• use [email protected] (#584) (ec949bc)

Does any of this look wrong? Please let us know.

↗️ file-entry-cache (indirect, 6.0.1 → 8.0.0) · Repo · Changelog

Release Notes

8.0.0

Removing support for Nodejs 10, 12, and 14

This is updating modules to the latest versions and supporting Nodejs >=16 moving forward with v8.0.0

What's Changed

• removing support for nodejs 12 and 14 by @jaredwray in #43

Full Changelog: v7.0.2...v8.0.0

7.0.2

What's Changed

• removing del module as no longer needed by @jaredwray in #40
• upgrading flat-cache to 3.2.0 by @jaredwray in #41

Full Changelog: v7.0.1...v7.0.2

7.0.1

What's Changed

• upgrading flat-cache to 3.1.1 by @jaredwray in #37
• upgrading chai to 4.3.10 by @jaredwray in #38
• upgrading eslint to 8.50.0 and mocha plugin by @jaredwray in #39

Full Changelog: v7.0.0...v7.0.1

7.0.0

What's Changed

• upgrading chai and mocha to latest by @jaredwray in #32
• removing package-lock and setting tests to nodejs versions by @jaredwray in #33
• adding code coverage reporting via codecov by @jaredwray in #34
• updating tests for master by @jaredwray in #35
• removing support for Nodejs version 10 by @jaredwray in #36

Full Changelog: v6.0.1...v7.0.0

Does any of this look wrong? Please let us know.

↗️ flat-cache (indirect, 3.0.4 → 4.0.1) · Repo · Changelog

Release Notes

4.0.1

What's Changed

• removing rimraf as core dependency by @jaredwray in #87
• chore: run prettier separately from eslint by @uncenter in #88
• refactor: prefer let/const over var by @uncenter in #89
• upgrading c8 to 9.1.0 by @jaredwray in #92
• upgrading prettier to 3.2.4 by @jaredwray in #93
• upgrading moch to 10.3.0 by @jaredwray in #95
• removing parts of keyv as a dependency by @jaredwray in #97

New Contributors

• @uncenter made their first contribution in #88

Full Changelog: v4.0.0...v4.0.1

4.0.0

Major version release

To stay up to date with latest module dependencies we moved to supporting nodejs >=16 with this release. All other functionality stayed the same.

What's Changed

• removing the testing on 21 by @jaredwray in #85
• removing support for node 10, 12, and 14 by @jaredwray in #86

Full Changelog: v3.2.0...v4.0.0

3.2.0

What's Changed

• [Fix] restore node 10 compat by @ljharb in #81

New Contributors

• @ljharb made their first contribution in #81

Full Changelog: v3.1.1...v3.2.0

3.1.1

What's Changed

• updating repo to use github actions and codecov by @jaredwray in #64
• updating mocha and chai by @jaredwray in #65
• adding in codecov badge by @jaredwray in #66
• upgrading flatted to 3.2.7 by @jaredwray in #67
• updating workflows with prs by @jaredwray in #71
• updating coverage reporting to work with codecov by @jaredwray in #72
• updating to show correct branch by @jaredwray in #73
• intoducing keyv to flat-cache - non invasive by @jaredwray in #74
• clean up of package.json by @jaredwray in #75
• upgrading chai to 4.3.10 by @jaredwray in #77
• upgrading flatted to 3.2.9 by @jaredwray in #78

New Contributors

• @jaredwray made their first contribution in #64

Full Changelog: v3.0.4...v3.1.1

Does any of this look wrong? Please let us know.

↗️ flatted (indirect, 3.2.7 → 3.3.3) · Repo

Commits

See the full diff on Github. The new version differs by 31 commits:

• 3.3.3
• ruf/linted Python + dev-dependencies updates
• explicit files in package.json
• 3.3.2
• Fix #81 - Removed published __pycache__ from npm
• 3.3.1
• Fixed another typo on TS definition
• 3.3.0
• Fixed types and TS logo in npm
• Removed jsr.json from npm
• 3.2.13
• Fixed typo in JSDoc TS
• 3.2.12
• Last attempt to fix jsr.io
• Still trying to fix jsr.io publishing
• 3.2.11
• Improved TS types
• Bumped jsr.io too
• 3.2.10
• Trying this jsr thing
• Updated dev-dependencies
• Updated all dev/dependencies
• Merge pull request #71 from WebReflection/python
• 3.2.9
• Added Python version of the very same thing
• 3.2.8
• Merge pull request #70 from WebReflection/issue-69
• Fix #69 - Make `$value` an explicit class field
• Removed a disturbingly unnecessary early return
• Merge pull request #63 from WebReflection/dependabot/npm_and_yarn/json5-2.2.3
• Bump json5 from 2.2.1 to 2.2.3

↗️ globals (indirect, 13.23.0 → 14.0.0) · Repo

Release Notes

14.0.0

Breaking

• Require Node.js 18 8ef880e

Improvements

• Zero dependencies (#209) da83698

v13.24.0...v14.0.0

13.24.0

• Add WebXR classes to browser (#206) 6736d9c

v13.23.0...v13.24.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

• 14.0.0
• Require Node.js 18
• Generate types rather than relying on `type-fest` (#209)
• Add script to get builtin globals (#207)
• 13.24.0
• Meta tweaks
• Add WebXR classes to `browser` (#206)

↗️ import-fresh (indirect, 3.3.0 → 3.3.1) · Repo

Release Notes

3.3.1

• Fix Bun compatibility (#32) 972690b

---

v3.3.0...v3.3.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

• 3.3.1
• Meta tweak
• Fix Bun compatibility (#32)
• Meta tweaks

🆕 @​eslint/config-array (added, 0.21.1)

🆕 @​eslint/config-helpers (added, 0.4.2)

🆕 @​eslint/core (added, 0.17.0)

🆕 @​eslint/object-schema (added, 2.1.7)

🆕 @​eslint/plugin-kit (added, 0.4.1)

🆕 @​humanfs/core (added, 0.19.1)

🆕 @​humanfs/node (added, 0.16.7)

🆕 @​humanwhocodes/retry (added, 0.4.3)

🆕 @​types/estree (added, 1.0.8)

🆕 json-buffer (added, 3.0.1)

🆕 keyv (added, 4.5.4)

🗑️ @​humanwhocodes/config-array (removed)

🗑️ @​humanwhocodes/object-schema (removed)

🗑️ @​ungap/structured-clone (removed)

🗑️ ansi-regex (removed)

🗑️ doctrine (removed)

🗑️ fs.realpath (removed)

🗑️ glob (removed)

🗑️ inflight (removed)

🗑️ inherits (removed)

🗑️ is-path-inside (removed)

🗑️ once (removed)

🗑️ path-is-absolute (removed)

🗑️ rimraf (removed)

🗑️ strip-ansi (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

🗑️ wrappy (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)