🚨 [security] Update eslint 8.52.0 → 9.39.2 (major)

[depfu]

---

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

---

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.52.0 → 9.39.2) · Repo · Changelog

Security Advisories 🚨

🚨 eslint has a Stack Overflow when serializing objects with circular references

There is a Stack Overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a Stack Overflow.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​eslint/eslintrc (indirect, 2.1.2 → 3.3.3) · Repo · Changelog

Release Notes

3.3.3 (from changelog)

Bug Fixes

• release v3.3.3 because publishing v3.3.2 failed (#211) (8aa555a)

3.3.1

3.3.1 (2025-03-11)

Bug Fixes

• correct types field in package.json (#184) (2f4cf3f)

3.3.0

3.3.0 (2025-02-21)

Features

• Add types to package (#179) (cb546be)

3.2.0

3.2.0 (2024-11-14)

Features

• merge rule.meta.defaultOptions before validation (#166) (d02f914)

3.1.0

3.1.0 (2024-05-17)

Features

• Expose loadConfigFile() function (#160) (59e890f)

Chores

• run tests in Node.js 22 (#154) (5e526f2)
• update dependency shelljs to ^0.8.5 (#156) (903b887)

3.0.2

3.0.2 (2024-02-12)

Chores

• maintenance update of globals to v14 (#152) (4151865)

3.0.1

3.0.1 (2024-02-09)

Documentation

• fix changelog for v3.0.0 (#144) (a613847)
• More explicit about all and recommended configs (#150) (0fabc74)

Chores

• upgrade espree@10.0.1 (#151) (8c39944)

3.0.0

3.0.0 (2023-12-27)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#142)
• Set default schema: [], drop support for function-style rules (#139)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#142) (737eb25)
• Set default schema: [], drop support for function-style rules (#139) (a6c240d)

Chores

• upgrade github actions (#143) (de34faf)

2.1.4

2.1.4 (2023-11-27)

Bug Fixes

• Use original plugin from disk in FlatCompat (#137) (1c4cf6a)

2.1.3

2.1.3 (2023-11-01)

Documentation

• Add CommonJS example to README (#134) (ad511f8), closes #133

Chores

• run tests in Node.js 21 (#130) (3b386f7)

Does any of this look wrong? Please let us know.

↗️ @​eslint/js (indirect, 8.52.0 → 9.39.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​types/json-schema (indirect, 7.0.9 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.10.0 → 8.15.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ eslint-scope (indirect, 7.2.2 → 8.4.0) · Repo · Changelog

Release Notes

8.0.2

8.0.2 (2024-07-08)

Bug Fixes

• Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)

Documentation

• document Security Policy (#122) (0d03700)

Chores

• switch to eslint flat config (#121) (59b1606)
• upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)

⚠ BREAKING CHANGES

• use ESTree directive property when searching for "use strict" (#118)
• class extends is evaluated in the class scope (#116)
• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
• use ESTree directive property when searching for "use strict" (#118) (23fe81f)

Bug Fixes

• class extends is evaluated in the class scope (#116) (42ef7a9)

Documentation

• Update README with analyze() options (#111) (2122fdb), closes #110

Chores

• Remove add-to-triage (#106) (dc75851)
• run tests in Node.js 21 (#109) (957748e)
• standardize npm script names (#105) (115ded3)

Does any of this look wrong? Please let us know.

↗️ eslint-visitor-keys (indirect, 3.4.3 → 4.2.1) · Repo · Changelog

Release Notes

4.0.0

4.0.0 (2024-02-08)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#63)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#63) (388b2ac)

Chores

• run tests in Node.js 21 (#61) (b23bfb7)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.6.1 → 10.4.0) · Repo · Changelog

Release Notes

10.4.0 (from changelog)

Features

• Add support for ES2026 using and await using declarations (#658) (39e0865)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.2.0 to ^4.2.1

10.3.0 (from changelog)

Features

• add support for Import Attributes and RegExp Modifiers (#639) (2fd4222)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.1.0 to ^4.2.0

10.2.0 (from changelog)

Features

• add the eslint-scope package (#615) (2ecfb8b)

Bug Fixes

• Update dependencies to avoid build failure (#631) (e8cd107)
• update links to eslint/js repo (#619) (956389a)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • eslint-visitor-keys bumped from ^4.0.0 to ^4.1.0

10.1.0

10.1.0 (2024-06-17)

Features

• Support ES2025 and RegExp duplicate named capturing groups (#608) (3059713)

10.0.1

10.0.1 (2024-02-09)

Chores

• upgrade eslint-visitor-keys@4.0.0 (#595) (6254a91)

10.0.0

10.0.0 (2024-01-25)

⚠ BREAKING CHANGES

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#589)

Features

• Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#589) (e79cfa4)

Bug Fixes

• upgrade acorn v8.11.3 (#590) (6d30382)

Chores

• Add PRs to triage project (#580) (086555e)
• Remove add-to-triage (#583) (3907385)
• run tests in Node.js 21 (#585) (1584ddb)
• standardize npm script names (#582) (b0767ef)
• use eslint-config-eslint@9.0.0 (#584) (ec949bc)

Does any of this look wrong? Please let us know.

↗️ flatted (indirect, 3.2.4 → 3.3.3) · Repo

Commits

See the full diff on Github. The new version differs by 44 commits:

• 3.3.3
• ruf/linted Python + dev-dependencies updates
• explicit files in package.json
• 3.3.2
• Fix #81 - Removed published __pycache__ from npm
• 3.3.1
• Fixed another typo on TS definition
• 3.3.0
• Fixed types and TS logo in npm
• Removed jsr.json from npm
• 3.2.13
• Fixed typo in JSDoc TS
• 3.2.12
• Last attempt to fix jsr.io
• Still trying to fix jsr.io publishing
• 3.2.11
• Improved TS types
• Bumped jsr.io too
• 3.2.10
• Trying this jsr thing
• Updated dev-dependencies
• Updated all dev/dependencies
• Merge pull request #71 from WebReflection/python
• 3.2.9
• Added Python version of the very same thing
• 3.2.8
• Merge pull request #70 from WebReflection/issue-69
• Fix #69 - Make `$value` an explicit class field
• Removed a disturbingly unnecessary early return
• Merge pull request #63 from WebReflection/dependabot/npm_and_yarn/json5-2.2.3
• Bump json5 from 2.2.1 to 2.2.3
• 3.2.7
• Updated dev-dependencies
• Merge pull request #60 from Fdawgs/patch-1
• Reduce published package size
• 3.2.6
• Fix #58 + updated dev dependencies + exported flatted/esm
• Merge pull request #55 from WebReflection/dependabot/npm_and_yarn/minimist-1.2.6
• Bump minimist from 1.2.5 to 1.2.6
• 3.2.5
• Fix #54 - Allow tools to read flatted/package.json
• Merge pull request #53 from karlhorky/patch-1
• Follow style of toJSON
• Fixed a few typos in the README

🆕 @​eslint/config-array (added, 0.21.1)

🆕 @​eslint/config-helpers (added, 0.4.2)

🆕 @​eslint/core (added, 0.17.0)

🆕 @​eslint/object-schema (added, 2.1.7)

🆕 @​eslint/plugin-kit (added, 0.4.1)

🆕 @​humanfs/core (added, 0.19.1)

🆕 @​humanfs/node (added, 0.16.7)

🆕 @​humanwhocodes/retry (added, 0.4.3)

🆕 @​types/estree (added, 1.0.8)

🆕 json-buffer (added, 3.0.1)

🆕 keyv (added, 4.5.4)

🗑️ @​humanwhocodes/config-array (removed)

🗑️ @​nodelib/fs.scandir (removed)

🗑️ @​nodelib/fs.walk (removed)

🗑️ @​ungap/structured-clone (removed)

🗑️ fastq (removed)

🗑️ graphemer (removed)

🗑️ is-path-inside (removed)

🗑️ queue-microtask (removed)

🗑️ reusify (removed)

🗑️ run-parallel (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[netlify]

❌ Deploy Preview for elea-toolkit failed.

Name	Link
🔨 Latest commit	8380ec4
🔍 Latest deploy log	https://app.netlify.com/projects/elea-toolkit/deploys/697b87b1b421be00086f54fd