fix(deps): update dependency eslint to v9 [security] #4220
Conversation
product-auto-label
bot
added
the
samples
|
/gcbrun |
trusted-contributions-gcf
bot
added
kokoro:force-run
Summary of ChangesHello @renovate-bot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request performs a significant upgrade of the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates eslint from version 8 to 9 to address a security vulnerability. While the update is necessary for security, upgrading eslint to a new major version introduces breaking changes. The current linting setup, which uses gts (Google TypeScript Style) and other plugins, is not compatible with ESLint v9. This will likely break the CI pipeline. I've added a specific comment with more details. Additionally, eslint should be a devDependency, not a dependency.
| "dependencies": { | ||
| "commander": "^12.0.0", | ||
| "eslint": "^8.57.0" | ||
| "eslint": "^9.0.0" |
There was a problem hiding this comment.
Upgrading eslint to v9 is a major version change that will likely break the build due to incompatibilities with other development dependencies.
gtsincompatibility: Thegtspackage (version5.3.0), used for linting via thelintscript, depends oneslint@^8.0.0and is not compatible with ESLint v9.eslint-plugin-nincompatibility: Theeslint-plugin-npackage (version^14.0.0) is not compatible with ESLint v9. It needs to be updated to^17.0.0or later to work with ESLint v9.
These incompatibilities will cause the lint and fix scripts to fail.
Before this upgrade can be merged, the packages gts and eslint-plugin-n must be updated to versions that support ESLint v9. However, [email protected] is the latest version and does not support ESLint v9.
Additionally, eslint is a development tool and should be in devDependencies, not dependencies.
2 participants
This PR contains the following updates:
^8.57.0→^9.0.0GitHub Vulnerability Alerts
CVE-2025-50537
There is a Stack Overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in
eslint/lib/shared/serialization.js. The exploit is triggered via theRuleTester.run()method, which validates test cases and checks for duplicates. During validation, the internal functioncheckDuplicateTestCase()is called, which in turn uses theisSerializable()function for serialization checks. When a circular reference object is passed in,isSerializable()enters infinite recursion, ultimately causing a Stack Overflow.Release Notes
eslint/eslint (eslint)
v9.39.2Compare Source
v9.39.1Compare Source
v9.39.0Compare Source
v9.38.0Compare Source
Features
ce40f74feat: updatecomplexityrule to only highlight function header (#20048) (Atul Nair)e37e590feat: correctno-loss-of-precisionfalse positives withenotation (#20187) (Francesco Trotta)Bug Fixes
50c3dfdfix: improve type support for isolated dependencies in pnpm (#20201) (Francesco Trotta)a1f06a3fix: correct SourceCode typings (#20114) (Pixel998)Documentation
462675adocs: improve web accessibility by hiding non-semantic character (#20205) (루밀LuMir)c070e65docs: correct formatting inno-irregular-whitespacerule documentation (#20203) (루밀LuMir)b39e71adocs: Update README (GitHub Actions Bot)cd39983docs: movecustom-formatterstype descriptions tonodejs-api(#20190) (Percy Ma)Chores
d17c795chore: upgrade @eslint/js@9.38.0 (#20221) (Milos Djermanovic)25d0e33chore: package.json update for @eslint/js release (Jenkins)c82b5efrefactor: Use types from @eslint/core (#20168) (Nicholas C. Zakas)ff31609ci: add Node.js 25 toci.yml(#20220) (루밀LuMir)004577eci: bump github/codeql-action from 3 to 4 (#20211) (dependabot[bot])eac71fbtest: remove use ofnodejsScopeoption of eslint-scope from tests (#20206) (Milos Djermanovic)4168a18chore: fix typo in legacy-eslint.js (#20202) (Sweta Tanwar)205dbd2chore: fix typos (#20200) (ntnyq)dbb200echore: use team member's username when name is not available in data (#20194) (Milos Djermanovic)8962089chore: mark deprecated rules as available until v11.0.0 (#20184) (Pixel998)v9.37.0Compare Source
Features
39f7fb4feat:preserve-caught-errorshould recognize all static "cause" keys (#20163) (Pixel998)f81eabcfeat: support TS syntax inno-restricted-imports(#19562) (Nitin Kumar)Bug Fixes
a129ccefix: correctno-loss-of-precisionfalse positives for leading zeros (#20164) (Francesco Trotta)09e04fcfix: add missing AST token types (#20172) (Pixel998)861c6dafix: correctESLinttypings (#20122) (Pixel998)Documentation
b950359docs: fix typos across the docs (#20182) (루밀LuMir)42498a2docs: improve ToC accessibility by hiding non-semantic character (#20181) (Percy Ma)29ea092docs: Update README (GitHub Actions Bot)5c97a04docs: showavailableUntilin deprecated rule banner (#20170) (Pixel998)90a71bfdocs: updateREADMEfiles to add badge and instructions (#20115) (루밀LuMir)1603ae1docs: update references frommastertomain(#20153) (루밀LuMir)Chores
afe8a13chore: update@eslint/jsdependency to version 9.37.0 (#20183) (Francesco Trotta)abee4cachore: package.json update for @eslint/js release (Jenkins)fc9381fchore: fix typos in comments (#20175) (overlookmotel)e1574a2chore: unpin jiti (#20173) (renovate[bot])e1ac05erefactor: markESLint.findConfigFile()asasync, add missing docs (#20157) (Pixel998)347906dchore: update eslint (#20149) (renovate[bot])0cb5897test: remove tmp dir created for circular fixes in multithread mode test (#20146) (Milos Djermanovic)bb99566ci: pinjitito version 2.5.1 (#20151) (Pixel998)177f669perf: improve worker count calculation for"auto"concurrency (#20067) (Francesco Trotta)448b57bchore: Mark deprecated formatting rules as available until v11.0.0 (#20144) (Milos Djermanovic)v9.36.0Compare Source
Features
47afcf6feat: correctpreserve-caught-erroredge cases (#20109) (Francesco Trotta)Bug Fixes
75b74d8fix: add missing rule option types (#20127) (ntnyq)1c0d850fix: updateeslint-all.jsto useObject.freezeforrulesobject (#20116) (루밀LuMir)7d61b7ffix: add missing scope types toScope.type(#20110) (Pixel998)7a670c3fix: correct rule option typings inrules.d.ts(#20084) (Pixel998)Documentation
b73ab12docs: update examples to usedefineConfig(#20131) (sethamus)31d9392docs: fix typos (#20118) (Pixel998)c7f861bdocs: Update README (GitHub Actions Bot)6b0c08bdocs: Update README (GitHub Actions Bot)91f97c5docs: Update README (GitHub Actions Bot)Chores
12411e8chore: upgrade @eslint/js@9.36.0 (#20139) (Milos Djermanovic)488cba6chore: package.json update for @eslint/js release (Jenkins)bac82a2ci: simplify renovate configuration (#19907) (唯然)c00bb37ci: bump actions/labeler from 5 to 6 (#20090) (dependabot[bot])fee751drefactor: usedefaultOptionsin rules (#20121) (Pixel998)1ace67dchore: update example to usedefineConfig(#20111) (루밀LuMir)4821963test: add missing loc information to error objects in rule tests (#20112) (루밀LuMir)b42c42echore: disallow use of deprecatedtypeproperty in core rule tests (#20094) (Milos Djermanovic)7bb498dtest: remove deprecatedtypeproperty from core rule tests (#20093) (Pixel998)e10cf2aci: bump actions/setup-node from 4 to 5 (#20089) (dependabot[bot])5cb0ce4refactor: usemeta.defaultOptionsinpreserve-caught-error(#20080) (Pixel998)f9f7cb5chore: package.json update for eslint-config-eslint release (Jenkins)81764b2chore: updateeslintpeer dependency ineslint-config-eslint(#20079) (Milos Djermanovic)v9.35.0Compare Source
Features
42761fafeat: implement suggestions for no-empty-function (#20057) (jaymarvelz)102f444feat: implement suggestions for no-empty-static-block (#20056) (jaymarvelz)e51fffffeat: addpreserve-caught-errorrule (#19913) (Amnish Singh Arora)Bug Fixes
10e7ae2fix: update uncloneable options error message (#20059) (soda-sorcery)bfa4601fix: ignore empty switch statements with comments in no-empty rule (#20045) (jaymarvelz)dfd11defix: addbeforeandafterto test case types (#20049) (Francesco Trotta)dabbe95fix: correct types forno-restricted-importsrule (#20034) (Milos Djermanovic)ea789c7fix: no-loss-of-precision false positive with uppercase exponent (#20032) (sethamus)Documentation
d265515docs: improve phrasing - "if" → "even if" from getting-started section (#20074) (jjangga0214)a355a0edocs: invert comparison logic for example inno-vardoc page (#20064) (OTonGitHub)5082fc2docs: Update README (GitHub Actions Bot)99cfd7edocs: add missing "the" in rule deprecation docs (#20050) (Josh Goldberg ✨)6ad8973docs: update--no-ignoreand--ignore-patterndocumentation (#20036) (Francesco Trotta)8033b19docs: add documentation for--no-config-lookup(#20033) (Francesco Trotta)Chores
da87f2fchore: upgrade @eslint/js@9.35.0 (#20077) (Milos Djermanovic)af2a087chore: package.json update for @eslint/js release (Jenkins)7055764test: removetests/lib/eslint/eslint.config.js(#20065) (Milos Djermanovic)84ffb96chore: update@eslint-community/eslint-utils(#20069) (Francesco Trotta)d5ef939refactor: remove deprecatedcontext.parserOptionsusage across rules (#20060) (sethamus)1b3881dchore: remove redundant word (#20058) (pxwanglu)v9.34.0Compare Source
Features
0bb777afeat: multithread linting (#19794) (Francesco Trotta)43a5f9efeat: add eslint-plugin-regexp to eslint-config-eslint base config (#19951) (Pixel998)Bug Fixes
9b89903fix: default value of accessor-pairs option in rule.d.ts file (#20024) (Tanuj Kanti)6c07420fix: fix spurious failure in neostandard integration test (#20023) (Kirk Waiblinger)676f4acfix: allow scientific notation with trailing zeros matching exponent (#20002) (Sweta Tanwar)Documentation
0b4a590docs: make rulesdir deprecation clearer (#20018) (Domenico Gemoli)327c672docs: Update README (GitHub Actions Bot)bf26229docs: Fix typo in core-concepts/index.md (#20009) (Tobias Hernstig)2309327docs: fix typo in the "Configuring Rules" section (#20001) (ghazi-git)2b87e21docs: [no-else-return] clarify sample code. (#19991) (Yuki Takada (Yukinosuke Takada))c36570cdocs: Update README (GitHub Actions Bot)Chores
f19ad94chore: upgrade to@eslint/[email protected](#20030) (Francesco Trotta)b48fa20chore: package.json update for @eslint/js release (Jenkins)4bce8a2chore: package.json update for eslint-config-eslint release (Jenkins)0c9999crefactor: prefer default options ingrouped-accessor-pairs(#20028) (루밀LuMir)d503f19ci: fixstale.yml(#20010) (루밀LuMir)e2dc67dci: centralizestale.yml(#19994) (루밀LuMir)7093cb8ci: bump actions/checkout from 4 to 5 (#20005) (dependabot[bot])v9.33.0Compare Source
Features
e07820efeat: add global object access detection to no-restricted-globals (#19939) (sethamus)90b050efeat: support explicit resource management inone-var(#19941) (Sweta Tanwar)Bug Fixes
732433cfix: allow any type formeta.docs.recommendedin custom rules (#19995) (Francesco Trotta)e8a6914fix: Fixed potential bug in check-emfile-handling.js (#19975) (諏訪原慶斗)Documentation
34f0723docs: playground button for TypeScript code example (#19671) (Tanuj Kanti)dc942a4docs: Update README (GitHub Actions Bot)5a4b6f7docs: Update no-multi-assign.md (#19979) (Yuki Takada (Yukinosuke Takada))247e156docs: add missing let declarations inno-plusplus(#19980) (Yuki Takada (Yukinosuke Takada))0d17242docs: Update README (GitHub Actions Bot)fa20b9ddocs: Clarify when to open an issue for a PR (#19974) (Nicholas C. Zakas)Build Related
27fa865build: useESLintclass to generate formatter examples (#19972) (Milos Djermanovic)Chores
4258046chore: update dependency @eslint/js to v9.33.0 (#19998) (renovate[bot])ad28371chore: package.json update for @eslint/js release (Jenkins)06a22f1test: resolve flakiness in --mcp flag test (#19993) (Pixel998)54920edtest: switch toLinter.ConfiginESLintRulestype tests (#19977) (Francesco Trotta)v9.32.0Compare Source
Features
1245000feat: support explicit resource management in core rules (#19828) (fnx)0e957a7feat: support typescript types in accessor rules (#19882) (fnx)Bug Fixes
960fd40fix: Upgrade @eslint/js (#19971) (Nicholas C. Zakas)bbf23fafix: Refactor reporting into FileReport (#19877) (Nicholas C. Zakas)d498887fix: bump @eslint/plugin-kit to 0.3.4 to resolve vulnerability (#19965) (Milos Djermanovic)f46fc6cfix: report only global references in no-implied-eval (#19932) (Nitin Kumar)7863d26fix: remove outdated types inParserOptions.ecmaFeatures(#19944) (ntnyq)3173305fix: update execScript message in no-implied-eval rule (#19937) (TKDev7)Documentation
86e7426docs: Update README (GitHub Actions Bot)Chores
50de1cechore: package.json update for @eslint/js release (Jenkins)74f01a3ci: unpinjitito version^2.5.1(#19970) (루밀LuMir)2ab1381ci: pinjitito version 2.4.2 (#19964) (Francesco Trotta)b7f7545test: switch to flat config mode inSourceCodetests (#19953) (Milos Djermanovic)f5a35e3test: switch to flat config mode in eslint-fuzzer (#19960) (Milos Djermanovic)e22af8crefactor: useCustomRuleDefinitionTypeinJSRuleDefinition(#19949) (Francesco Trotta)e855717chore: switch performance tests to hyperfine (#19919) (Francesco Trotta)2f73a23test: switch to flat config mode inast-utilstests (#19948) (Milos Djermanovic)c565a53chore: excludefurther_reading_links.jsonfrom Prettier formatting (#19943) (Milos Djermanovic)v9.31.0Compare Source
Features
35cf44cfeat: output full actual location in rule tester if different (#19904) (ST-DDT)a6a6325feat: support explicit resource management inno-loop-func(#19895) (Milos Djermanovic)4682cdcfeat: support explicit resource management inno-undef-init(#19894) (Milos Djermanovic)5848216feat: support explicit resource management ininit-declarations(#19893) (Milos Djermanovic)bb370b8feat: support explicit resource management inno-const-assign(#19892) (Milos Djermanovic)Bug Fixes
07fac6cfix: retry on EMFILE when writing autofix results (#19926) (TKDev7)28cc7abfix: Remove incorrect RuleContext types (#19910) (Nicholas C. Zakas)Documentation
664cb44docs: Update README (GitHub Actions Bot)40dbe2adocs: fix mismatch betweenglobalIgnores()code and text (#19914) (MaoShizhong)5a0069ddocs: Update README (GitHub Actions Bot)fef04b5docs: Update working on issues info (#19902) (Nicholas C. Zakas)Chores
3ddd454chore: upgrade to@eslint/[email protected](#19935) (Francesco Trotta)d5054e5chore: package.json update for @eslint/js release (Jenkins)0f4a378chore: update eslint (#19933) (renovate[bot])76c2340chore: bump mocha to v11 (#19917) (루밀LuMir)v9.30.1Compare Source
Bug Fixes
e91bb87fix: allow separate default and named type imports (#19899) (xbinaryx)Documentation
ab7c625docs: Update README (GitHub Actions Bot)dae1e5bdocs: update jsdoc's link (#19896) (JamesVanWaza)Chores
b035f74chore: upgrade to@eslint/[email protected](#19906) (Francesco Trotta)b3dbc16chore: package.json update for @eslint/js release (Jenkins)v9.30.0Compare Source
Features
52a5fcafeat: SupportbasePathproperty in config objects (#19879) (Milos Djermanovic)4ab4482feat: addallowSeparateTypeImportsoption tono-duplicate-imports(#19872) (sethamus)b8a7e7afeat: throw error when column is negative ingetIndexFromLoc(#19831) (루밀LuMir)Bug Fixes
6a0f164fix: handlenulltypelocingetIndexFromLocmethod (#19862) (루밀LuMir)3fbcd70fix: update error message forno-restricted-properties(#19855) (Tanuj Kanti)7ef4cf7fix: remove unnecessary semicolon from fixes (#19857) (Francesco Trotta)7dabc38fix: useprocess.versionin--env-info(#19865) (TKDev7)Documentation
8662ed1docs: adopt eslint-stylistic sub packages related changes (#19887) (ntnyq)20158b0docs: typo in comment for unused variables handling (#19870) (leopardracer)ebfb5b4docs: Fixed Typo in configuration-files.md (#19873) (0-20)4112fd0docs: clarify that boolean is still allowed for rulemeta.deprecated(#19866) (Bryan Mishkin)Chores
2b6491cchore: upgrade to@eslint/[email protected](#19889) (Francesco Trotta)5a5d526chore: package.json update for @eslint/js release (Jenkins)eaf8a41chore: Correct typos in linter tests (#19878) (kilavvy)v9.29.0Compare Source
Features
f686fcbfeat: addecmaVersion: 2026, parsingusingandawait using(#19832) (Milos Djermanovic)19cdd22feat: prune suppressions for non-existent files (#19825) (TKDev7)b3d720ffeat: add ES2025 globals (#19835) (fisker Cheung)677a283feat: add auto-accessor fields support to class-methods-use-this (#19789) (sethamus)dbba058feat: allow global type declaration inno-var(#19714) (Remco Haszing)342bd29feat: ignore type annotations in no-restricted-globals (#19781) (sethamus)786bcd1feat: add allowProperties option to no-restricted-properties (#19772) (sethamus)05b66d0feat: addsourceCode.isGlobalReference(node)method (#19695) (Nitin Kumar)Bug Fixes
85c082cfix: explicit matching behavior with negated patterns and arrays (#19845) (Milos Djermanovic)9bda4a9fix: fixLintOptions.filterCodeBlocktypes (#19837) (ntnyq)7ab77a2fix: correct breaking deprecation of FlatConfig type (#19826) (Logicer)1ba3318fix: addlanguageanddialectstono-use-before-define(#19808) (Francesco Trotta)Documentation
00e3e6adocs: add support for custom name parameter toincludeIgnoreFile(#19795) (루밀LuMir)3aed075docs: Update README (GitHub Actions Bot)a2f888ddocs: enhance documentation with links and fix typos (#19761) (루밀LuMir)53c3235docs: update to clarify prompt usage (#19748) (Jennifer Davis)Chores
5c114c9chore: upgrade @eslint/js@9.29.0 (#19851) (Milos Djermanovic)acf2201chore: package.json update for @eslint/js release (Jenkins)a806994refactor: Remove eslintrc from flat config functionality (#19833) (Nicholas C. Zakas)152ed51test: switch to flat config mode in code path analysis tests (#19824) (Milos Djermanovic)b647239chore: Update first-party dependencies faster with Renovate (#19822) (Nicholas C. Zakas)7abe42erefactor: SafeEmitter -> SourceCodeVisitor (#19708) (Nicholas C. Zakas)e392895perf: improve time complexity ofgetLocFromIndex(#19782) (루밀LuMir)0ed289cchore: remove accidentally committed file (#19807) (Francesco Trotta)v9.28.0Compare Source
Features
b0674befeat: Customization of serialization for languageOptions (#19760) (Nicholas C. Zakas)a95721ffeat: Add--pass-on-unpruned-suppressionsCLI option (#19773) (Milos Djermanovic)bfd0e7afeat: support TypeScript syntax inno-use-before-define(#19566) (Tanuj Kanti)68c61c0feat: support TS syntax inno-shadow(#19565) (Nitin Kumar)0f773effeat: support TS syntax inno-magic-numbers(#19561) (Nitin Kumar)c4a6b60feat: add allowTypeAnnotation to func-style (#19754) (sethamus)b03ad17feat: add TypeScript support toprefer-arrow-callback(#19678) (Tanuj Kanti)bc3c331feat: ignore overloaded function declarations in func-style rule (#19755) (sethamus)Bug Fixes
eea3e7efix: Remove configured global variables fromGlobalScope#implicit(#19779) (Milos Djermanovic)a467de3fix: update context.report types (#19751) (Nitin Kumar)fd467bbfix: remove interopDefault to use jiti's default (#19697) (sethamus)72d16e3fix: avoid false positive inno-unassigned-varsfor declare module (#19746) (Azat S.)81c3c93fix: curly types (#19750) (Eli)Documentation
3ec2082docs: Nested arrays in files config entry (#19799) (Nicholas C. Zakas)89a65b0docs: clarify how config arrays can apply to subsets of files (#19788) (Shais Ch)2ba8a0ddocs: Add description of meta.namespace to plugin docs (#19798) (Nicholas C. Zakas)59dd7e6docs: updatefunc-stylewith examples (#19793) (Tanuj Kanti)e9129e0docs: add global scope'simplicitfield to Scope Manager docs (#19770) (Milos Djermanovic)52f5b7adocs: fix minor typos and add links (#19743) (루밀LuMir)00716a3docs: upfront recommend against using the no-return-await rule (#19727) (Mike DiDomizio)Chores
175b7b8chore: upgrade to@eslint/[email protected](#19802) (Francesco Trotta)844f5a6chore: package.json update for @eslint/js release (Jenkins)62b1c1bchore: update globals to v16 (#19791) (Nitin Kumar)e8a1cb8chore: ignore jiti-v2.0 & jiti-v2.1 for renovate (#19786) (Nitin Kumar)43d3975chore: Add Copilot Instructions file (#19753) (Nicholas C. Zakas)2dfb5ebtest: updateSourceCodeTraversertests (#19763) (Milos Djermanovic)5bc21f9chore: add*.code-workspaceto.gitignore(#19771) (루밀LuMir)f4fa40erefactor: NodeEventGenerator -> SourceCodeTraverser (#19679) (Nicholas C. Zakas)0f49329refactor: use a service to emit warnings (#19725) (Francesco Trotta)20a9e59chore: update dependency shelljs to ^0.10.0 (#19740) (renovate[bot])Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.