This release includes a security fix in the
eslint-utils package, which is a dependency of ESLint. The security issue affects users that run ESLint on untrusted source code (e.g. servers that lint the user’s project as a service). By taking advantage of a bug in a certain piece of analysis, a user could supply malicious source text that causes arbitrary code to be executed in the linting process.
- This issue affects versions of
eslint-utilsbetween v1.2.0 and v1.4.0.
- ESLint versions between v5.3.0 and v6.2.0 are potentially vulnerable (their allowed dependencies include vulnerable
eslint-utilsversions). However, these versions of ESLint can still be used safely if the
eslint-utilsdependency is updated to the latest version (e.g. by updating
eslint-utilsin a lockfile, or purging
- ESLint v6.2.1 is not vulnerable to the issue.
4aeeeedDocs: update docs for ecmaVersion 2020 (#12120) (silverwind)
6886148Docs: Add duplicate keys limitation to accessor-pairs (#12124) (Milos Djermanovic)