[Snyk] Security upgrade eslint from 8.57.1 to 10.0.0#14038
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-AJV-15274295
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
There was a problem hiding this comment.
Pull request overview
This PR is an automated security upgrade generated by Snyk to fix a high-severity Regular Expression Denial of Service (ReDoS) vulnerability (SNYK-JS-AJV-15274295) in the ajv dependency. The upgrade changes the ESLint version from 8.57.1 to 10.0.0 in the bundle-bug-finder tool, which is a development utility used to detect bugs in bundled JavaScript code.
Changes:
- Upgrades ESLint from version ^8.53.0 to ^10.0.0 in tools/bundle-bug-finder/package.json
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ESLint 10 dropped support for `.eslintrc` files. Replace with `eslint.config.js` flat config. Remove Babel parser dependencies since the default espree parser handles the `no-undef` use case. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Wrap cleanup `Deno.removeSync` calls in try-catch so that failures to remove files that don't yet exist (e.g. when validation fails before creating them) don't mask the real error. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
ESLint 10 dropped support for
Verified locally that flat config + default parser + |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The bundled quarto.js contains import attributes (`with { type: "json" }`)
which require ES2025+. Use "latest" so espree tracks the spec automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
tools/bundle-bug-finder/package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-AJV-15274295
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Regular Expression Denial of Service (ReDoS)