🚨 [security] Update eslint 8.32.0 → 10.9.1 (major) by depfu[bot] · Pull Request #260 · https-quantumblockchainai-atlassian-net/mkdocs-material

depfu · 2026-08-29T20:26:25Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.32.0 → 10.9.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes
update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes
fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes
disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

Release Notes

9.1.2 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)
Bug Fixes
Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)
Documentation
document Security Policy (#122) (0d03700)
Chores
switch to eslint flat config (#121) (59b1606)
upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)
⚠ BREAKING CHANGES
use ESTree directive property when searching for "use strict" (#118)
class extends is evaluated in the class scope (#116)
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)
Features
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
use ESTree directive property when searching for "use strict" (#118) (23fe81f)
Bug Fixes
class extends is evaluated in the class scope (#116) (42ef7a9)
Documentation
Update README with analyze() options (#111) (2122fdb), closes #110
Chores
Remove add-to-triage (#106) (dc75851)
run tests in Node.js 21 (#109) (957748e)
standardize npm script names (#105) (115ded3)

7.2.2

7.2.2 (2023-07-27)
Chores
Add PRs to triage (#104) (a4dd888)
generate provenance statements when release (#102) (a27ce6b)

7.2.1

7.2.1 (2023-05-31)
Chores
run tests on Node.js v20 (#97) (675f7de)
set up release-please (#99) (6bc2619)

7.2.0

Features
70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)
Documentation
25abacf docs: add badges (#89) (Milos Djermanovic)
Build Related
a8811b8 build: add node v18 (#91) (唯然)
Chores
3dbad80 chore: add triage action (#95) (Milos Djermanovic)
34ffedc ci: add Node v19 (#94) (Milos Djermanovic)
4c00534 ci: update Github actions (#93) (Deepshika S)
6c8ccf2 chore: add funding field (#92) (Deepshika S)

7.1.1

Bug Fixes
4e1d24c fix: ignore "use strict" directives in ES3 (#87) (Milos Djermanovic)
Chores
8938109 chore: upgrade espree@9.3.1 eslint-visitor-keys@3.3.0 (#88) (Milos Djermanovic)
ceb8bdd ci: use node v16 (#84) (Nitin Kumar)
62e147b test: add tests with year-based ecmaVersion (#83) (Milos Djermanovic)

7.1.0

Features
d756f1e feat: Add sourceType:commonjs support (#81) (Nicholas C. Zakas)

7.0.0

Breaking Changes
22a55c0 feat!: support class static blocks (#80) (Milos Djermanovic)
Build Related
4aafb61 build: upgrade eslint-release to v3.2.0 to support conventional commits (#79) (Milos Djermanovic)
263c762 Build: add node v17 (#76) (唯然)

6.0.0

4ee1d80 Fix: Ensure correct version in package (#73) (Nicholas C. Zakas)
82a7e6d Breaking: Switch to ESM (fixes #70) (#71) (Brett Zamir)
0b4a5f1 Update: support class fields (refs eslint/eslint#14343) (#69) (Toru Nagashima)
39f8cfc Chore: upgrade estraverse to version 5 (#68) (Rouven Weßling)
ae27ff3 Docs: Add range to espree options in README (fixes #66) (#67) (Alan Liang)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.
Root Cause
File: esm/index.js:29 (identical in cjs/index.js)
 const resolver = (input, lazy, parsed, $) => output => {
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
const k = ke[y];
const value = output[k]; if (value instanceof Primitive) {
const tmp = input[value]; // Bug is here
No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:
has type "object" → passes the typeof tmp === object guard at line 30
is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.
Replication Steps
 const Flatted = require('flatted'); const parsed = Flatted.parse('[{"x":"__proto__"}]');
parsed.x.polluted = 'pwned';
console.log([].polluted); // Returns true
Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.
Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:
// Before (vulnerable)
const tmp = input[value];
// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Summary
flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
Impact
Denial of Service (DoS). Any application that passes untrusted input to flatted.parse() can be crashed by an unauthenticated attacker with a single request.
flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.
Proof of Concept
constflatted=require('flatted');// Build deeply nested circular reference chain
constdepth=20000;
constarr=newArray(depth+1);
arr[0]='{"a":"1"}';
for(leti=1;i<=depth;i++){
arr[i]={"a":"${i + 1}"};
}
arr[depth]='{"a":"leaf"}';
constpayload=JSON.stringify(arr);
flatted.parse(payload);// RangeError: Maximum call stack size exceeded
Fix
The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive revive() to a stack-based loop.
Affected Versions
All versions prior to the PR #88 fix.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:
Reverts default value for options.indent to two spaces ' '.
Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed
Remove default indent by @mohd-akram in #24
🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
chore: publish workflow by @OlafConijn in #42
New Contributors
@mohd-akram made their first contribution in #24
@OlafConijn made their first contribution in #41
@aashutoshrathi made their first contribution in #33
Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @eslint-community/eslint-utils (added, 4.10.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.5)

🆕 @eslint/config-helpers (added, 0.7.0)

🆕 @eslint/core (added, 1.2.1)

🆕 @eslint/object-schema (added, 3.0.5)

🆕 @eslint/plugin-kit (added, 0.7.2)

🆕 @humanfs/core (added, 0.19.2)

🆕 @humanfs/node (added, 0.16.8)

🆕 @humanfs/types (added, 0.15.0)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.9)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @types/json-buffer (removed)

🗑️ @typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

🗑️ grapheme-splitter (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ strip-json-comments (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

bolt-new-by-stackblitz · 2026-08-29T20:26:29Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2026-08-29T20:26:29Z

⚠️ No Changeset found

Latest commit: 037b2ed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-29T20:26:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eslint@8.32.0 ⏵ 10.9.1	⁺¹			⁺⁴⁷

View full report

mergify · 2026-08-29T20:27:06Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

depfu · 2026-08-29T20:26:25Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.32.0 → 10.9.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes
update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes
fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes
disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

Release Notes

9.1.2 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)
Bug Fixes
Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)
Documentation
document Security Policy (#122) (0d03700)
Chores
switch to eslint flat config (#121) (59b1606)
upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)
⚠ BREAKING CHANGES
use ESTree directive property when searching for "use strict" (#118)
class extends is evaluated in the class scope (#116)
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)
Features
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
use ESTree directive property when searching for "use strict" (#118) (23fe81f)
Bug Fixes
class extends is evaluated in the class scope (#116) (42ef7a9)
Documentation
Update README with analyze() options (#111) (2122fdb), closes #110
Chores
Remove add-to-triage (#106) (dc75851)
run tests in Node.js 21 (#109) (957748e)
standardize npm script names (#105) (115ded3)

7.2.2

7.2.2 (2023-07-27)
Chores
Add PRs to triage (#104) (a4dd888)
generate provenance statements when release (#102) (a27ce6b)

7.2.1

7.2.1 (2023-05-31)
Chores
run tests on Node.js v20 (#97) (675f7de)
set up release-please (#99) (6bc2619)

7.2.0

Features
70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)
Documentation
25abacf docs: add badges (#89) (Milos Djermanovic)
Build Related
a8811b8 build: add node v18 (#91) (唯然)
Chores
3dbad80 chore: add triage action (#95) (Milos Djermanovic)
34ffedc ci: add Node v19 (#94) (Milos Djermanovic)
4c00534 ci: update Github actions (#93) (Deepshika S)
6c8ccf2 chore: add funding field (#92) (Deepshika S)

7.1.1

Bug Fixes
4e1d24c fix: ignore "use strict" directives in ES3 (#87) (Milos Djermanovic)
Chores
8938109 chore: upgrade espree@9.3.1 eslint-visitor-keys@3.3.0 (#88) (Milos Djermanovic)
ceb8bdd ci: use node v16 (#84) (Nitin Kumar)
62e147b test: add tests with year-based ecmaVersion (#83) (Milos Djermanovic)

7.1.0

Features
d756f1e feat: Add sourceType:commonjs support (#81) (Nicholas C. Zakas)

7.0.0

Breaking Changes
22a55c0 feat!: support class static blocks (#80) (Milos Djermanovic)
Build Related
4aafb61 build: upgrade eslint-release to v3.2.0 to support conventional commits (#79) (Milos Djermanovic)
263c762 Build: add node v17 (#76) (唯然)

6.0.0

4ee1d80 Fix: Ensure correct version in package (#73) (Nicholas C. Zakas)
82a7e6d Breaking: Switch to ESM (fixes #70) (#71) (Brett Zamir)
0b4a5f1 Update: support class fields (refs eslint/eslint#14343) (#69) (Toru Nagashima)
39f8cfc Chore: upgrade estraverse to version 5 (#68) (Rouven Weßling)
ae27ff3 Docs: Add range to espree options in README (fixes #66) (#67) (Alan Liang)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.
Root Cause
File: esm/index.js:29 (identical in cjs/index.js)
 const resolver = (input, lazy, parsed, $) => output => {
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
const k = ke[y];
const value = output[k]; if (value instanceof Primitive) {
const tmp = input[value]; // Bug is here
No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:
has type "object" → passes the typeof tmp === object guard at line 30
is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.
Replication Steps
 const Flatted = require('flatted'); const parsed = Flatted.parse('[{"x":"__proto__"}]');
parsed.x.polluted = 'pwned';
console.log([].polluted); // Returns true
Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.
Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:
// Before (vulnerable)
const tmp = input[value];
// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Summary
flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
Impact
Denial of Service (DoS). Any application that passes untrusted input to flatted.parse() can be crashed by an unauthenticated attacker with a single request.
flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.
Proof of Concept
constflatted=require('flatted');// Build deeply nested circular reference chain
constdepth=20000;
constarr=newArray(depth+1);
arr[0]='{"a":"1"}';
for(leti=1;i<=depth;i++){
arr[i]={"a":"${i + 1}"};
}
arr[depth]='{"a":"leaf"}';
constpayload=JSON.stringify(arr);
flatted.parse(payload);// RangeError: Maximum call stack size exceeded
Fix
The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive revive() to a stack-based loop.
Affected Versions
All versions prior to the PR #88 fix.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:
Reverts default value for options.indent to two spaces ' '.
Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed
Remove default indent by @mohd-akram in #24
🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
chore: publish workflow by @OlafConijn in #42
New Contributors
@mohd-akram made their first contribution in #24
@OlafConijn made their first contribution in #41
@aashutoshrathi made their first contribution in #33
Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @eslint-community/eslint-utils (added, 4.10.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.5)

🆕 @eslint/config-helpers (added, 0.7.0)

🆕 @eslint/core (added, 1.2.1)

🆕 @eslint/object-schema (added, 3.0.5)

🆕 @eslint/plugin-kit (added, 0.7.2)

🆕 @humanfs/core (added, 0.19.2)

🆕 @humanfs/node (added, 0.16.8)

🆕 @humanfs/types (added, 0.15.0)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.9)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @types/json-buffer (removed)

🗑️ @typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

🗑️ grapheme-splitter (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ strip-json-comments (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

bolt-new-by-stackblitz · 2026-08-29T20:26:29Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2026-08-29T20:26:29Z

⚠️ No Changeset found

Latest commit: 037b2ed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-29T20:26:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eslint@8.32.0 ⏵ 10.9.1	⁺¹			⁺⁴⁷

View full report

mergify · 2026-08-29T20:27:06Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

depfu · 2026-08-29T20:26:25Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.32.0 → 10.9.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes
update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes
fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes
disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

Release Notes

9.1.2 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)
Bug Fixes
Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)
Documentation
document Security Policy (#122) (0d03700)
Chores
switch to eslint flat config (#121) (59b1606)
upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)
⚠ BREAKING CHANGES
use ESTree directive property when searching for "use strict" (#118)
class extends is evaluated in the class scope (#116)
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)
Features
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
use ESTree directive property when searching for "use strict" (#118) (23fe81f)
Bug Fixes
class extends is evaluated in the class scope (#116) (42ef7a9)
Documentation
Update README with analyze() options (#111) (2122fdb), closes #110
Chores
Remove add-to-triage (#106) (dc75851)
run tests in Node.js 21 (#109) (957748e)
standardize npm script names (#105) (115ded3)

7.2.2

7.2.2 (2023-07-27)
Chores
Add PRs to triage (#104) (a4dd888)
generate provenance statements when release (#102) (a27ce6b)

7.2.1

7.2.1 (2023-05-31)
Chores
run tests on Node.js v20 (#97) (675f7de)
set up release-please (#99) (6bc2619)

7.2.0

Features
70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)
Documentation
25abacf docs: add badges (#89) (Milos Djermanovic)
Build Related
a8811b8 build: add node v18 (#91) (唯然)
Chores
3dbad80 chore: add triage action (#95) (Milos Djermanovic)
34ffedc ci: add Node v19 (#94) (Milos Djermanovic)
4c00534 ci: update Github actions (#93) (Deepshika S)
6c8ccf2 chore: add funding field (#92) (Deepshika S)

7.1.1

Bug Fixes
4e1d24c fix: ignore "use strict" directives in ES3 (#87) (Milos Djermanovic)
Chores
8938109 chore: upgrade espree@9.3.1 eslint-visitor-keys@3.3.0 (#88) (Milos Djermanovic)
ceb8bdd ci: use node v16 (#84) (Nitin Kumar)
62e147b test: add tests with year-based ecmaVersion (#83) (Milos Djermanovic)

7.1.0

Features
d756f1e feat: Add sourceType:commonjs support (#81) (Nicholas C. Zakas)

7.0.0

Breaking Changes
22a55c0 feat!: support class static blocks (#80) (Milos Djermanovic)
Build Related
4aafb61 build: upgrade eslint-release to v3.2.0 to support conventional commits (#79) (Milos Djermanovic)
263c762 Build: add node v17 (#76) (唯然)

6.0.0

4ee1d80 Fix: Ensure correct version in package (#73) (Nicholas C. Zakas)
82a7e6d Breaking: Switch to ESM (fixes #70) (#71) (Brett Zamir)
0b4a5f1 Update: support class fields (refs eslint/eslint#14343) (#69) (Toru Nagashima)
39f8cfc Chore: upgrade estraverse to version 5 (#68) (Rouven Weßling)
ae27ff3 Docs: Add range to espree options in README (fixes #66) (#67) (Alan Liang)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.
Root Cause
File: esm/index.js:29 (identical in cjs/index.js)
 const resolver = (input, lazy, parsed, $) => output => {
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
const k = ke[y];
const value = output[k]; if (value instanceof Primitive) {
const tmp = input[value]; // Bug is here
No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:
has type "object" → passes the typeof tmp === object guard at line 30
is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.
Replication Steps
 const Flatted = require('flatted'); const parsed = Flatted.parse('[{"x":"__proto__"}]');
parsed.x.polluted = 'pwned';
console.log([].polluted); // Returns true
Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.
Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:
// Before (vulnerable)
const tmp = input[value];
// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Summary
flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
Impact
Denial of Service (DoS). Any application that passes untrusted input to flatted.parse() can be crashed by an unauthenticated attacker with a single request.
flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.
Proof of Concept
constflatted=require('flatted');// Build deeply nested circular reference chain
constdepth=20000;
constarr=newArray(depth+1);
arr[0]='{"a":"1"}';
for(leti=1;i<=depth;i++){
arr[i]={"a":"${i + 1}"};
}
arr[depth]='{"a":"leaf"}';
constpayload=JSON.stringify(arr);
flatted.parse(payload);// RangeError: Maximum call stack size exceeded
Fix
The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive revive() to a stack-based loop.
Affected Versions
All versions prior to the PR #88 fix.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:
Reverts default value for options.indent to two spaces ' '.
Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed
Remove default indent by @mohd-akram in #24
🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
chore: publish workflow by @OlafConijn in #42
New Contributors
@mohd-akram made their first contribution in #24
@OlafConijn made their first contribution in #41
@aashutoshrathi made their first contribution in #33
Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @eslint-community/eslint-utils (added, 4.10.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.5)

🆕 @eslint/config-helpers (added, 0.7.0)

🆕 @eslint/core (added, 1.2.1)

🆕 @eslint/object-schema (added, 3.0.5)

🆕 @eslint/plugin-kit (added, 0.7.2)

🆕 @humanfs/core (added, 0.19.2)

🆕 @humanfs/node (added, 0.16.8)

🆕 @humanfs/types (added, 0.15.0)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.9)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @types/json-buffer (removed)

🗑️ @typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

🗑️ grapheme-splitter (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ strip-json-comments (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

bolt-new-by-stackblitz · 2026-08-29T20:26:29Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2026-08-29T20:26:29Z

⚠️ No Changeset found

Latest commit: 037b2ed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-29T20:26:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eslint@8.32.0 ⏵ 10.9.1	⁺¹			⁺⁴⁷

View full report

mergify · 2026-08-29T20:27:06Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

depfu · 2026-08-29T20:26:25Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.32.0 → 10.9.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes
update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes
fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes
disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

Release Notes

9.1.2 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)
Bug Fixes
Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)
Documentation
document Security Policy (#122) (0d03700)
Chores
switch to eslint flat config (#121) (59b1606)
upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)
⚠ BREAKING CHANGES
use ESTree directive property when searching for "use strict" (#118)
class extends is evaluated in the class scope (#116)
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)
Features
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
use ESTree directive property when searching for "use strict" (#118) (23fe81f)
Bug Fixes
class extends is evaluated in the class scope (#116) (42ef7a9)
Documentation
Update README with analyze() options (#111) (2122fdb), closes #110
Chores
Remove add-to-triage (#106) (dc75851)
run tests in Node.js 21 (#109) (957748e)
standardize npm script names (#105) (115ded3)

7.2.2

7.2.2 (2023-07-27)
Chores
Add PRs to triage (#104) (a4dd888)
generate provenance statements when release (#102) (a27ce6b)

7.2.1

7.2.1 (2023-05-31)
Chores
run tests on Node.js v20 (#97) (675f7de)
set up release-please (#99) (6bc2619)

7.2.0

Features
70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)
Documentation
25abacf docs: add badges (#89) (Milos Djermanovic)
Build Related
a8811b8 build: add node v18 (#91) (唯然)
Chores
3dbad80 chore: add triage action (#95) (Milos Djermanovic)
34ffedc ci: add Node v19 (#94) (Milos Djermanovic)
4c00534 ci: update Github actions (#93) (Deepshika S)
6c8ccf2 chore: add funding field (#92) (Deepshika S)

7.1.1

Bug Fixes
4e1d24c fix: ignore "use strict" directives in ES3 (#87) (Milos Djermanovic)
Chores
8938109 chore: upgrade espree@9.3.1 eslint-visitor-keys@3.3.0 (#88) (Milos Djermanovic)
ceb8bdd ci: use node v16 (#84) (Nitin Kumar)
62e147b test: add tests with year-based ecmaVersion (#83) (Milos Djermanovic)

7.1.0

Features
d756f1e feat: Add sourceType:commonjs support (#81) (Nicholas C. Zakas)

7.0.0

Breaking Changes
22a55c0 feat!: support class static blocks (#80) (Milos Djermanovic)
Build Related
4aafb61 build: upgrade eslint-release to v3.2.0 to support conventional commits (#79) (Milos Djermanovic)
263c762 Build: add node v17 (#76) (唯然)

6.0.0

4ee1d80 Fix: Ensure correct version in package (#73) (Nicholas C. Zakas)
82a7e6d Breaking: Switch to ESM (fixes #70) (#71) (Brett Zamir)
0b4a5f1 Update: support class fields (refs eslint/eslint#14343) (#69) (Toru Nagashima)
39f8cfc Chore: upgrade estraverse to version 5 (#68) (Rouven Weßling)
ae27ff3 Docs: Add range to espree options in README (fixes #66) (#67) (Alan Liang)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.
Root Cause
File: esm/index.js:29 (identical in cjs/index.js)
 const resolver = (input, lazy, parsed, $) => output => {
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
const k = ke[y];
const value = output[k]; if (value instanceof Primitive) {
const tmp = input[value]; // Bug is here
No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:
has type "object" → passes the typeof tmp === object guard at line 30
is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.
Replication Steps
 const Flatted = require('flatted'); const parsed = Flatted.parse('[{"x":"__proto__"}]');
parsed.x.polluted = 'pwned';
console.log([].polluted); // Returns true
Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.
Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:
// Before (vulnerable)
const tmp = input[value];
// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Summary
flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
Impact
Denial of Service (DoS). Any application that passes untrusted input to flatted.parse() can be crashed by an unauthenticated attacker with a single request.
flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.
Proof of Concept
constflatted=require('flatted');// Build deeply nested circular reference chain
constdepth=20000;
constarr=newArray(depth+1);
arr[0]='{"a":"1"}';
for(leti=1;i<=depth;i++){
arr[i]={"a":"${i + 1}"};
}
arr[depth]='{"a":"leaf"}';
constpayload=JSON.stringify(arr);
flatted.parse(payload);// RangeError: Maximum call stack size exceeded
Fix
The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive revive() to a stack-based loop.
Affected Versions
All versions prior to the PR #88 fix.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:
Reverts default value for options.indent to two spaces ' '.
Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed
Remove default indent by @mohd-akram in #24
🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
chore: publish workflow by @OlafConijn in #42
New Contributors
@mohd-akram made their first contribution in #24
@OlafConijn made their first contribution in #41
@aashutoshrathi made their first contribution in #33
Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @eslint-community/eslint-utils (added, 4.10.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.5)

🆕 @eslint/config-helpers (added, 0.7.0)

🆕 @eslint/core (added, 1.2.1)

🆕 @eslint/object-schema (added, 3.0.5)

🆕 @eslint/plugin-kit (added, 0.7.2)

🆕 @humanfs/core (added, 0.19.2)

🆕 @humanfs/node (added, 0.16.8)

🆕 @humanfs/types (added, 0.15.0)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.9)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @types/json-buffer (removed)

🗑️ @typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

🗑️ grapheme-splitter (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ strip-json-comments (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

bolt-new-by-stackblitz · 2026-08-29T20:26:29Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2026-08-29T20:26:29Z

⚠️ No Changeset found

Latest commit: 037b2ed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-29T20:26:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eslint@8.32.0 ⏵ 10.9.1	⁺¹			⁺⁴⁷

View full report

mergify · 2026-08-29T20:27:06Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

depfu · 2026-08-29T20:26:25Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.32.0 → 10.9.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes
update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes
fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes
disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

Release Notes

9.1.2 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)
Bug Fixes
Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)
Documentation
document Security Policy (#122) (0d03700)
Chores
switch to eslint flat config (#121) (59b1606)
upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)
⚠ BREAKING CHANGES
use ESTree directive property when searching for "use strict" (#118)
class extends is evaluated in the class scope (#116)
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)
Features
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
use ESTree directive property when searching for "use strict" (#118) (23fe81f)
Bug Fixes
class extends is evaluated in the class scope (#116) (42ef7a9)
Documentation
Update README with analyze() options (#111) (2122fdb), closes #110
Chores
Remove add-to-triage (#106) (dc75851)
run tests in Node.js 21 (#109) (957748e)
standardize npm script names (#105) (115ded3)

7.2.2

7.2.2 (2023-07-27)
Chores
Add PRs to triage (#104) (a4dd888)
generate provenance statements when release (#102) (a27ce6b)

7.2.1

7.2.1 (2023-05-31)
Chores
run tests on Node.js v20 (#97) (675f7de)
set up release-please (#99) (6bc2619)

7.2.0

Features
70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)
Documentation
25abacf docs: add badges (#89) (Milos Djermanovic)
Build Related
a8811b8 build: add node v18 (#91) (唯然)
Chores
3dbad80 chore: add triage action (#95) (Milos Djermanovic)
34ffedc ci: add Node v19 (#94) (Milos Djermanovic)
4c00534 ci: update Github actions (#93) (Deepshika S)
6c8ccf2 chore: add funding field (#92) (Deepshika S)

7.1.1

Bug Fixes
4e1d24c fix: ignore "use strict" directives in ES3 (#87) (Milos Djermanovic)
Chores
8938109 chore: upgrade espree@9.3.1 eslint-visitor-keys@3.3.0 (#88) (Milos Djermanovic)
ceb8bdd ci: use node v16 (#84) (Nitin Kumar)
62e147b test: add tests with year-based ecmaVersion (#83) (Milos Djermanovic)

7.1.0

Features
d756f1e feat: Add sourceType:commonjs support (#81) (Nicholas C. Zakas)

7.0.0

Breaking Changes
22a55c0 feat!: support class static blocks (#80) (Milos Djermanovic)
Build Related
4aafb61 build: upgrade eslint-release to v3.2.0 to support conventional commits (#79) (Milos Djermanovic)
263c762 Build: add node v17 (#76) (唯然)

6.0.0

4ee1d80 Fix: Ensure correct version in package (#73) (Nicholas C. Zakas)
82a7e6d Breaking: Switch to ESM (fixes #70) (#71) (Brett Zamir)
0b4a5f1 Update: support class fields (refs eslint/eslint#14343) (#69) (Toru Nagashima)
39f8cfc Chore: upgrade estraverse to version 5 (#68) (Rouven Weßling)
ae27ff3 Docs: Add range to espree options in README (fixes #66) (#67) (Alan Liang)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.
Root Cause
File: esm/index.js:29 (identical in cjs/index.js)
 const resolver = (input, lazy, parsed, $) => output => {
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
const k = ke[y];
const value = output[k]; if (value instanceof Primitive) {
const tmp = input[value]; // Bug is here
No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:
has type "object" → passes the typeof tmp === object guard at line 30
is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.
Replication Steps
 const Flatted = require('flatted'); const parsed = Flatted.parse('[{"x":"__proto__"}]');
parsed.x.polluted = 'pwned';
console.log([].polluted); // Returns true
Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.
Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:
// Before (vulnerable)
const tmp = input[value];
// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Summary
flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
Impact
Denial of Service (DoS). Any application that passes untrusted input to flatted.parse() can be crashed by an unauthenticated attacker with a single request.
flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.
Proof of Concept
constflatted=require('flatted');// Build deeply nested circular reference chain
constdepth=20000;
constarr=newArray(depth+1);
arr[0]='{"a":"1"}';
for(leti=1;i<=depth;i++){
arr[i]={"a":"${i + 1}"};
}
arr[depth]='{"a":"leaf"}';
constpayload=JSON.stringify(arr);
flatted.parse(payload);// RangeError: Maximum call stack size exceeded
Fix
The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive revive() to a stack-based loop.
Affected Versions
All versions prior to the PR #88 fix.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:
Reverts default value for options.indent to two spaces ' '.
Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed
Remove default indent by @mohd-akram in #24
🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
chore: publish workflow by @OlafConijn in #42
New Contributors
@mohd-akram made their first contribution in #24
@OlafConijn made their first contribution in #41
@aashutoshrathi made their first contribution in #33
Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @eslint-community/eslint-utils (added, 4.10.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.5)

🆕 @eslint/config-helpers (added, 0.7.0)

🆕 @eslint/core (added, 1.2.1)

🆕 @eslint/object-schema (added, 3.0.5)

🆕 @eslint/plugin-kit (added, 0.7.2)

🆕 @humanfs/core (added, 0.19.2)

🆕 @humanfs/node (added, 0.16.8)

🆕 @humanfs/types (added, 0.15.0)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.9)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @types/json-buffer (removed)

🗑️ @typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

🗑️ grapheme-splitter (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ strip-json-comments (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

bolt-new-by-stackblitz · 2026-08-29T20:26:29Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2026-08-29T20:26:29Z

⚠️ No Changeset found

Latest commit: 037b2ed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-29T20:26:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eslint@8.32.0 ⏵ 10.9.1	⁺¹			⁺⁴⁷

View full report

mergify · 2026-08-29T20:27:06Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

depfu · 2026-08-29T20:26:25Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.32.0 → 10.9.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes
update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes
fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes
disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

Release Notes

9.1.2 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)
Bug Fixes
Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)
Documentation
document Security Policy (#122) (0d03700)
Chores
switch to eslint flat config (#121) (59b1606)
upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)
⚠ BREAKING CHANGES
use ESTree directive property when searching for "use strict" (#118)
class extends is evaluated in the class scope (#116)
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)
Features
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
use ESTree directive property when searching for "use strict" (#118) (23fe81f)
Bug Fixes
class extends is evaluated in the class scope (#116) (42ef7a9)
Documentation
Update README with analyze() options (#111) (2122fdb), closes #110
Chores
Remove add-to-triage (#106) (dc75851)
run tests in Node.js 21 (#109) (957748e)
standardize npm script names (#105) (115ded3)

7.2.2

7.2.2 (2023-07-27)
Chores
Add PRs to triage (#104) (a4dd888)
generate provenance statements when release (#102) (a27ce6b)

7.2.1

7.2.1 (2023-05-31)
Chores
run tests on Node.js v20 (#97) (675f7de)
set up release-please (#99) (6bc2619)

7.2.0

Features
70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)
Documentation
25abacf docs: add badges (#89) (Milos Djermanovic)
Build Related
a8811b8 build: add node v18 (#91) (唯然)
Chores
3dbad80 chore: add triage action (#95) (Milos Djermanovic)
34ffedc ci: add Node v19 (#94) (Milos Djermanovic)
4c00534 ci: update Github actions (#93) (Deepshika S)
6c8ccf2 chore: add funding field (#92) (Deepshika S)

7.1.1

Bug Fixes
4e1d24c fix: ignore "use strict" directives in ES3 (#87) (Milos Djermanovic)
Chores
8938109 chore: upgrade espree@9.3.1 eslint-visitor-keys@3.3.0 (#88) (Milos Djermanovic)
ceb8bdd ci: use node v16 (#84) (Nitin Kumar)
62e147b test: add tests with year-based ecmaVersion (#83) (Milos Djermanovic)

7.1.0

Features
d756f1e feat: Add sourceType:commonjs support (#81) (Nicholas C. Zakas)

7.0.0

Breaking Changes
22a55c0 feat!: support class static blocks (#80) (Milos Djermanovic)
Build Related
4aafb61 build: upgrade eslint-release to v3.2.0 to support conventional commits (#79) (Milos Djermanovic)
263c762 Build: add node v17 (#76) (唯然)

6.0.0

4ee1d80 Fix: Ensure correct version in package (#73) (Nicholas C. Zakas)
82a7e6d Breaking: Switch to ESM (fixes #70) (#71) (Brett Zamir)
0b4a5f1 Update: support class fields (refs eslint/eslint#14343) (#69) (Toru Nagashima)
39f8cfc Chore: upgrade estraverse to version 5 (#68) (Rouven Weßling)
ae27ff3 Docs: Add range to espree options in README (fixes #66) (#67) (Alan Liang)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.
Root Cause
File: esm/index.js:29 (identical in cjs/index.js)
 const resolver = (input, lazy, parsed, $) => output => {
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
const k = ke[y];
const value = output[k]; if (value instanceof Primitive) {
const tmp = input[value]; // Bug is here
No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:
has type "object" → passes the typeof tmp === object guard at line 30
is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.
Replication Steps
 const Flatted = require('flatted'); const parsed = Flatted.parse('[{"x":"__proto__"}]');
parsed.x.polluted = 'pwned';
console.log([].polluted); // Returns true
Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.
Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:
// Before (vulnerable)
const tmp = input[value];
// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Summary
flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
Impact
Denial of Service (DoS). Any application that passes untrusted input to flatted.parse() can be crashed by an unauthenticated attacker with a single request.
flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.
Proof of Concept
constflatted=require('flatted');// Build deeply nested circular reference chain
constdepth=20000;
constarr=newArray(depth+1);
arr[0]='{"a":"1"}';
for(leti=1;i<=depth;i++){
arr[i]={"a":"${i + 1}"};
}
arr[depth]='{"a":"leaf"}';
constpayload=JSON.stringify(arr);
flatted.parse(payload);// RangeError: Maximum call stack size exceeded
Fix
The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive revive() to a stack-based loop.
Affected Versions
All versions prior to the PR #88 fix.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:
Reverts default value for options.indent to two spaces ' '.
Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed
Remove default indent by @mohd-akram in #24
🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
chore: publish workflow by @OlafConijn in #42
New Contributors
@mohd-akram made their first contribution in #24
@OlafConijn made their first contribution in #41
@aashutoshrathi made their first contribution in #33
Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @eslint-community/eslint-utils (added, 4.10.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.5)

🆕 @eslint/config-helpers (added, 0.7.0)

🆕 @eslint/core (added, 1.2.1)

🆕 @eslint/object-schema (added, 3.0.5)

🆕 @eslint/plugin-kit (added, 0.7.2)

🆕 @humanfs/core (added, 0.19.2)

🆕 @humanfs/node (added, 0.16.8)

🆕 @humanfs/types (added, 0.15.0)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.9)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @types/json-buffer (removed)

🗑️ @typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

🗑️ grapheme-splitter (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ strip-json-comments (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

bolt-new-by-stackblitz · 2026-08-29T20:26:29Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2026-08-29T20:26:29Z

⚠️ No Changeset found

Latest commit: 037b2ed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-29T20:26:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eslint@8.32.0 ⏵ 10.9.1	⁺¹			⁺⁴⁷

View full report

mergify · 2026-08-29T20:27:06Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

depfu · 2026-08-29T20:26:25Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.32.0 → 10.9.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes
update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes
fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes
disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

Release Notes

9.1.2 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)
Bug Fixes
Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)
Documentation
document Security Policy (#122) (0d03700)
Chores
switch to eslint flat config (#121) (59b1606)
upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)
⚠ BREAKING CHANGES
use ESTree directive property when searching for "use strict" (#118)
class extends is evaluated in the class scope (#116)
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)
Features
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
use ESTree directive property when searching for "use strict" (#118) (23fe81f)
Bug Fixes
class extends is evaluated in the class scope (#116) (42ef7a9)
Documentation
Update README with analyze() options (#111) (2122fdb), closes #110
Chores
Remove add-to-triage (#106) (dc75851)
run tests in Node.js 21 (#109) (957748e)
standardize npm script names (#105) (115ded3)

7.2.2

7.2.2 (2023-07-27)
Chores
Add PRs to triage (#104) (a4dd888)
generate provenance statements when release (#102) (a27ce6b)

7.2.1

7.2.1 (2023-05-31)
Chores
run tests on Node.js v20 (#97) (675f7de)
set up release-please (#99) (6bc2619)

7.2.0

Features
70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)
Documentation
25abacf docs: add badges (#89) (Milos Djermanovic)
Build Related
a8811b8 build: add node v18 (#91) (唯然)
Chores
3dbad80 chore: add triage action (#95) (Milos Djermanovic)
34ffedc ci: add Node v19 (#94) (Milos Djermanovic)
4c00534 ci: update Github actions (#93) (Deepshika S)
6c8ccf2 chore: add funding field (#92) (Deepshika S)

7.1.1

Bug Fixes
4e1d24c fix: ignore "use strict" directives in ES3 (#87) (Milos Djermanovic)
Chores
8938109 chore: upgrade espree@9.3.1 eslint-visitor-keys@3.3.0 (#88) (Milos Djermanovic)
ceb8bdd ci: use node v16 (#84) (Nitin Kumar)
62e147b test: add tests with year-based ecmaVersion (#83) (Milos Djermanovic)

7.1.0

Features
d756f1e feat: Add sourceType:commonjs support (#81) (Nicholas C. Zakas)

7.0.0

Breaking Changes
22a55c0 feat!: support class static blocks (#80) (Milos Djermanovic)
Build Related
4aafb61 build: upgrade eslint-release to v3.2.0 to support conventional commits (#79) (Milos Djermanovic)
263c762 Build: add node v17 (#76) (唯然)

6.0.0

4ee1d80 Fix: Ensure correct version in package (#73) (Nicholas C. Zakas)
82a7e6d Breaking: Switch to ESM (fixes #70) (#71) (Brett Zamir)
0b4a5f1 Update: support class fields (refs eslint/eslint#14343) (#69) (Toru Nagashima)
39f8cfc Chore: upgrade estraverse to version 5 (#68) (Rouven Weßling)
ae27ff3 Docs: Add range to espree options in README (fixes #66) (#67) (Alan Liang)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.
Root Cause
File: esm/index.js:29 (identical in cjs/index.js)
 const resolver = (input, lazy, parsed, $) => output => {
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
const k = ke[y];
const value = output[k]; if (value instanceof Primitive) {
const tmp = input[value]; // Bug is here
No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:
has type "object" → passes the typeof tmp === object guard at line 30
is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.
Replication Steps
 const Flatted = require('flatted'); const parsed = Flatted.parse('[{"x":"__proto__"}]');
parsed.x.polluted = 'pwned';
console.log([].polluted); // Returns true
Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.
Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:
// Before (vulnerable)
const tmp = input[value];
// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Summary
flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
Impact
Denial of Service (DoS). Any application that passes untrusted input to flatted.parse() can be crashed by an unauthenticated attacker with a single request.
flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.
Proof of Concept
constflatted=require('flatted');// Build deeply nested circular reference chain
constdepth=20000;
constarr=newArray(depth+1);
arr[0]='{"a":"1"}';
for(leti=1;i<=depth;i++){
arr[i]={"a":"${i + 1}"};
}
arr[depth]='{"a":"leaf"}';
constpayload=JSON.stringify(arr);
flatted.parse(payload);// RangeError: Maximum call stack size exceeded
Fix
The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive revive() to a stack-based loop.
Affected Versions
All versions prior to the PR #88 fix.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:
Reverts default value for options.indent to two spaces ' '.
Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed
Remove default indent by @mohd-akram in #24
🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
chore: publish workflow by @OlafConijn in #42
New Contributors
@mohd-akram made their first contribution in #24
@OlafConijn made their first contribution in #41
@aashutoshrathi made their first contribution in #33
Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @eslint-community/eslint-utils (added, 4.10.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.5)

🆕 @eslint/config-helpers (added, 0.7.0)

🆕 @eslint/core (added, 1.2.1)

🆕 @eslint/object-schema (added, 3.0.5)

🆕 @eslint/plugin-kit (added, 0.7.2)

🆕 @humanfs/core (added, 0.19.2)

🆕 @humanfs/node (added, 0.16.8)

🆕 @humanfs/types (added, 0.15.0)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.9)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @types/json-buffer (removed)

🗑️ @typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

🗑️ grapheme-splitter (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ strip-json-comments (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

bolt-new-by-stackblitz · 2026-08-29T20:26:29Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2026-08-29T20:26:29Z

⚠️ No Changeset found

Latest commit: 037b2ed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-29T20:26:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eslint@8.32.0 ⏵ 10.9.1	⁺¹			⁺⁴⁷

View full report

mergify · 2026-08-29T20:27:06Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

depfu · 2026-08-29T20:26:25Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint (8.32.0 → 10.9.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in cross-spawn

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Release Notes

7.0.6 (from changelog)

Bug Fixes
update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (from changelog)

Bug Fixes
fix escaping bug introduced by backtracking (640d391)

7.0.4 (from changelog)

Bug Fixes
disable regexp backtracking (#160) (5ff3a07)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

Release Notes

9.1.2 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (from changelog)

Dependencies
The following workspace dependencies were updated
devDependencies
eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1
espree bumped from ^11.1.0 to ^11.1.1

8.0.2

8.0.2 (2024-07-08)
Bug Fixes
Definition#name in catch patterns should be Identifier node (#127) (8082caa)

8.0.1

8.0.1 (2024-03-20)
Documentation
document Security Policy (#122) (0d03700)
Chores
switch to eslint flat config (#121) (59b1606)
upgrade espree@10.0.1, eslint-visitor-keys@4.0.0 (#119) (6f95a94)

8.0.0

8.0.0 (2024-01-04)
⚠ BREAKING CHANGES
use ESTree directive property when searching for "use strict" (#118)
class extends is evaluated in the class scope (#116)
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115)
Features
Require Node.js ^18.18.0 || ^20.9.0 || >=21.1.0 (#115) (ed67857)
use ESTree directive property when searching for "use strict" (#118) (23fe81f)
Bug Fixes
class extends is evaluated in the class scope (#116) (42ef7a9)
Documentation
Update README with analyze() options (#111) (2122fdb), closes #110
Chores
Remove add-to-triage (#106) (dc75851)
run tests in Node.js 21 (#109) (957748e)
standardize npm script names (#105) (115ded3)

7.2.2

7.2.2 (2023-07-27)
Chores
Add PRs to triage (#104) (a4dd888)
generate provenance statements when release (#102) (a27ce6b)

7.2.1

7.2.1 (2023-05-31)
Chores
run tests on Node.js v20 (#97) (675f7de)
set up release-please (#99) (6bc2619)

7.2.0

Features
70c8db1 feat: Add isGlobalReturn method on scopeManager. (#96) (Nicholas C. Zakas)
Documentation
25abacf docs: add badges (#89) (Milos Djermanovic)
Build Related
a8811b8 build: add node v18 (#91) (唯然)
Chores
3dbad80 chore: add triage action (#95) (Milos Djermanovic)
34ffedc ci: add Node v19 (#94) (Milos Djermanovic)
4c00534 ci: update Github actions (#93) (Deepshika S)
6c8ccf2 chore: add funding field (#92) (Deepshika S)

7.1.1

Bug Fixes
4e1d24c fix: ignore "use strict" directives in ES3 (#87) (Milos Djermanovic)
Chores
8938109 chore: upgrade espree@9.3.1 eslint-visitor-keys@3.3.0 (#88) (Milos Djermanovic)
ceb8bdd ci: use node v16 (#84) (Nitin Kumar)
62e147b test: add tests with year-based ecmaVersion (#83) (Milos Djermanovic)

7.1.0

Features
d756f1e feat: Add sourceType:commonjs support (#81) (Nicholas C. Zakas)

7.0.0

Breaking Changes
22a55c0 feat!: support class static blocks (#80) (Milos Djermanovic)
Build Related
4aafb61 build: upgrade eslint-release to v3.2.0 to support conventional commits (#79) (Milos Djermanovic)
263c762 Build: add node v17 (#76) (唯然)

6.0.0

4ee1d80 Fix: Ensure correct version in package (#73) (Nicholas C. Zakas)
82a7e6d Breaking: Switch to ESM (fixes #70) (#71) (Brett Zamir)
0b4a5f1 Update: support class fields (refs eslint/eslint#14343) (#69) (Toru Nagashima)
39f8cfc Chore: upgrade estraverse to version 5 (#68) (Rouven Weßling)
ae27ff3 Docs: Add range to espree options in README (fixes #66) (#67) (Alan Liang)

Does any of this look wrong? Please let us know.

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index
keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it
with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate
parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype
to the consumer. Any code that subsequently writes to that property will pollute the global prototype.
Root Cause
File: esm/index.js:29 (identical in cjs/index.js)
 const resolver = (input, lazy, parsed, $) => output => {
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
const k = ke[y];
const value = output[k]; if (value instanceof Primitive) {
const tmp = input[value]; // Bug is here
No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:
has type "object" → passes the typeof tmp === object guard at line 30
is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.
Replication Steps
 const Flatted = require('flatted'); const parsed = Flatted.parse('[{"x":"__proto__"}]');
parsed.x.polluted = 'pwned';
console.log([].polluted); // Returns true
Impact
An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.
Recommended solution
Validate that the index string represents an integer within the bounds of input before accessing it:
// Before (vulnerable)
const tmp = input[value];
// After (safe)
const idx = +value; // coerce boxed String → number
const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)
? input[idx]
: undefined;

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Summary
flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.
Impact
Denial of Service (DoS). Any application that passes untrusted input to flatted.parse() can be crashed by an unauthenticated attacker with a single request.
flatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.
Proof of Concept
constflatted=require('flatted');// Build deeply nested circular reference chain
constdepth=20000;
constarr=newArray(depth+1);
arr[0]='{"a":"1"}';
for(leti=1;i<=depth;i++){
arr[i]={"a":"${i + 1}"};
}
arr[depth]='{"a":"leaf"}';
constpayload=JSON.stringify(arr);
flatted.parse(payload);// RangeError: Maximum call stack size exceeded
Fix
The maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive revive() to a stack-based loop.
Affected Versions
All versions prior to the PR #88 fix.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

Security Advisories 🚨

🚨 word-wrap vulnerable to Regular Expression Denial of Service

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Release Notes

1.2.5

Changes:
Reverts default value for options.indent to two spaces ' '.
Full Changelog: 1.2.4...1.2.5

1.2.4

What's Changed
Remove default indent by @mohd-akram in #24
🔒fix: CVE 2023 26115 (2) by @OlafConijn in #41
🔒 fix: CVE-2023-26115 by @aashutoshrathi in #33
chore: publish workflow by @OlafConijn in #42
New Contributors
@mohd-akram made their first contribution in #24
@OlafConijn made their first contribution in #41
@aashutoshrathi made their first contribution in #33
Full Changelog: 1.2.3...1.2.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

🆕 @eslint-community/eslint-utils (added, 4.10.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.5)

🆕 @eslint/config-helpers (added, 0.7.0)

🆕 @eslint/core (added, 1.2.1)

🆕 @eslint/object-schema (added, 3.0.5)

🆕 @eslint/plugin-kit (added, 0.7.2)

🆕 @humanfs/core (added, 0.19.2)

🆕 @humanfs/node (added, 0.16.8)

🆕 @humanfs/types (added, 0.15.0)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.9)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @types/json-buffer (removed)

🗑️ @typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

🗑️ grapheme-splitter (removed)

🗑️ js-sdsl (removed)

🗑️ lodash.merge (removed)

🗑️ strip-json-comments (removed)

🗑️ text-table (removed)

🗑️ type-fest (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

bolt-new-by-stackblitz · 2026-08-29T20:26:29Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2026-08-29T20:26:29Z

⚠️ No Changeset found

Latest commit: 037b2ed

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-29T20:26:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eslint@8.32.0 ⏵ 10.9.1	⁺¹			⁺⁴⁷

View full report

mergify · 2026-08-29T20:27:06Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

Update eslint to version 10.9.1
037b2ed

depfuBot added the depfu label Aug 29, 2026

depfuBot mentioned this pull request Aug 29, 2026
🚨 [security] Update eslint 8.32.0 → 10.8.0 (major) #254
Closed

Update eslint to version 10.9.1
037b2ed

depfuBot added the depfu label Aug 29, 2026

depfuBot mentioned this pull request Aug 29, 2026
🚨 [security] Update eslint 8.32.0 → 10.8.0 (major) #254
Closed

Update eslint to version 10.9.1
037b2ed

depfuBot added the depfu label Aug 29, 2026

depfuBot mentioned this pull request Aug 29, 2026
🚨 [security] Update eslint 8.32.0 → 10.8.0 (major) #254
Closed

Update eslint to version 10.9.1
037b2ed

depfuBot added the depfu label Aug 29, 2026

depfuBot mentioned this pull request Aug 29, 2026
🚨 [security] Update eslint 8.32.0 → 10.8.0 (major) #254
Closed

Update eslint to version 10.9.1
037b2ed

depfuBot added the depfu label Aug 29, 2026

depfuBot mentioned this pull request Aug 29, 2026
🚨 [security] Update eslint 8.32.0 → 10.8.0 (major) #254
Closed

Update eslint to version 10.9.1
037b2ed

depfuBot added the depfu label Aug 29, 2026

depfuBot mentioned this pull request Aug 29, 2026
🚨 [security] Update eslint 8.32.0 → 10.8.0 (major) #254
Closed

Update eslint to version 10.9.1
037b2ed

depfuBot added the depfu label Aug 29, 2026

depfuBot mentioned this pull request Aug 29, 2026
🚨 [security] Update eslint 8.32.0 → 10.8.0 (major) #254
Closed

Update eslint to version 10.9.1
037b2ed

depfuBot added the depfu label Aug 29, 2026

depfuBot mentioned this pull request Aug 29, 2026
🚨 [security] Update eslint 8.32.0 → 10.8.0 (major) #254
Closed

Uh oh!

Conversation

depfuBot commented Aug 29, 2026

What changed?

✳️ eslint (8.32.0 → 10.9.1) · Repo · Changelog

↗️ @​types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

↗️ @​types/semver (indirect, 7.3.13 → 7.8.0) · Repo

↗️ acorn (indirect, 8.8.0 → 8.18.0) · Repo

↗️ ajv (indirect, 6.12.6 → 6.15.0) · Repo

↗️ cross-spawn (indirect, 7.0.3 → 7.0.6) · Repo · Changelog

7.0.6 (from changelog)

Bug Fixes

7.0.5 (from changelog)

Bug Fixes

7.0.4 (from changelog)

Bug Fixes

↗️ eslint-scope (indirect, 5.1.1 → 9.1.2) · Repo · Changelog

9.1.2 (from changelog)

Dependencies

9.1.1 (from changelog)

Dependencies

8.0.2 (2024-07-08)

Bug Fixes

8.0.1 (2024-03-20)

Documentation

Chores

8.0.0 (2024-01-04)

⚠ BREAKING CHANGES

Features

Bug Fixes

Documentation

Chores

7.2.2 (2023-07-27)

Chores

7.2.1 (2023-05-31)

Chores

Features

Documentation

Build Related

Chores

Bug Fixes

Chores

Features

Breaking Changes

Build Related

↗️ espree (indirect, 9.4.1 → 11.2.0) · Repo · Changelog

↗️ esquery (indirect, 1.4.0 → 1.7.0) · Repo

↗️ estraverse (indirect, 4.3.0 → 5.3.0) · Repo

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Summary

Impact

Proof of Concept

Fix

Affected Versions

↗️ keyv (indirect, 4.3.2 → 4.5.4) · Repo

↗️ optionator (indirect, 0.9.1 → 0.9.4) · Repo · Changelog

↗️ word-wrap (indirect, 1.2.3 → 1.2.5) · Repo

What's Changed

New Contributors

🆕 @​eslint-community/eslint-utils (added, 4.10.1)

🆕 @​eslint-community/regexpp (added, 4.12.2)

🆕 @​eslint/config-array (added, 0.23.5)

🆕 @​eslint/config-helpers (added, 0.7.0)

🆕 @​eslint/core (added, 1.2.1)

🆕 @​eslint/object-schema (added, 3.0.5)

🆕 @​eslint/plugin-kit (added, 0.7.2)

🆕 @​humanfs/core (added, 0.19.2)

🆕 @​humanfs/node (added, 0.16.8)

🆕 @​humanfs/types (added, 0.15.0)

🆕 @​humanwhocodes/retry (added, 0.4.3)

🆕 @​types/esrecurse (added, 4.3.1)

🆕 @​types/estree (added, 1.0.9)

🗑️ @​eslint/eslintrc (removed)

🗑️ @​humanwhocodes/config-array (removed)

🗑️ @​humanwhocodes/object-schema (removed)

🗑️ @​types/json-buffer (removed)

🗑️ @​typescript-eslint/utils (removed)

🗑️ compress-brotli (removed)

🗑️ doctrine (removed)

🗑️ globals (removed)

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo

🆕 @eslint-community/eslint-utils (added, 4.10.1)

🆕 @eslint-community/regexpp (added, 4.12.2)

🆕 @eslint/config-array (added, 0.23.5)

🆕 @eslint/config-helpers (added, 0.7.0)

🆕 @eslint/core (added, 1.2.1)

🆕 @eslint/object-schema (added, 3.0.5)

🆕 @eslint/plugin-kit (added, 0.7.2)

🆕 @humanfs/core (added, 0.19.2)

🆕 @humanfs/node (added, 0.16.8)

🆕 @humanfs/types (added, 0.15.0)

🆕 @humanwhocodes/retry (added, 0.4.3)

🆕 @types/esrecurse (added, 4.3.1)

🆕 @types/estree (added, 1.0.9)

🗑️ @eslint/eslintrc (removed)

🗑️ @humanwhocodes/config-array (removed)

🗑️ @humanwhocodes/object-schema (removed)

🗑️ @types/json-buffer (removed)

🗑️ @typescript-eslint/utils (removed)

↗️ @types/json-schema (indirect, 7.0.11 → 7.0.15) · Repo

↗️ @types/semver (indirect, 7.3.13 → 7.8.0) · Repo