Skip to content

[Snyk] Security upgrade eslint from 7.25.0 to 9.0.0#550

Open
twilio-product-security wants to merge 1 commit into
masterfrom
snyk-fix-b4347e3bf95ae41eaf8265f3c2a40bb4
Open

[Snyk] Security upgrade eslint from 7.25.0 to 9.0.0#550
twilio-product-security wants to merge 1 commit into
masterfrom
snyk-fix-b4347e3bf95ae41eaf8265f3c2a40bb4

Conversation

@twilio-product-security

Copy link
Copy Markdown

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • package.json
  • package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
critical severity Prototype Pollution
SNYK-JS-FLATTED-15700433
  278  

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

@twilio-product-security

Copy link
Copy Markdown
Author

Merge Risk: High

This is a significant upgrade, jumping two major versions from 7.x to 9.x. It introduces substantial breaking changes, most notably a completely new configuration system.

Key Breaking Changes in v9.0.0

  • New Configuration Format (Flat Config): The largest change is the move from the traditional .eslintrc.* file to a new eslint.config.js file, known as "flat config". The old format is now deprecated. Projects must migrate their configuration to the new format, or the linter will not work as expected. As a temporary workaround, you can set the ESLINT_USE_FLAT_CONFIG=false environment variable to continue using your .eslintrc file.
  • Node.js Support: Support for Node.js versions older than 18.18.0 and version 19 has been dropped.
  • Removed Core Rules: The valid-jsdoc and require-jsdoc rules have been removed. You must now use the eslint-plugin-jsdoc plugin for this functionality.
  • Removed Formatters: Several formatters have been removed, including checkstyle, compact, junit, and tap. Only stylish, html, json, and json-with-meta remain.

Key Breaking Changes in v8.0.0

  • Node.js Support: Support for Node.js versions 10, 13, and 15 was dropped.
  • API Changes: The CLIEngine class was removed and replaced by the ESLint class, which affects programmatic integrations.
  • Stricter Rules: The eslint:recommended configuration was updated with stricter checks.

Recommendation: This upgrade requires mandatory and significant changes to your project's configuration. Developers must migrate their .eslintrc file to the new eslint.config.js format. It is highly recommended to follow the official migration guides and test your linting setup thoroughly after upgrading.

Sources:

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants