Skip to content

[Security] Bump eslint-utils from 1.3.1 to 1.4.2

Bucknell, Mary S. requested to merge dependabot/npm_and_yarn/eslint-utils-1.4.2 into master

Created by: dependabot-preview[bot]

Bumps eslint-utils from 1.3.1 to 1.4.2. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Critical severity vulnerability that affects eslint-utils

'getStaticValue' function can execute arbitrary code

Impact

getStaticValue function can execute arbitrary code.

Patches

This problem has been patched in 1.4.1. Please update eslint-utils.

Workarounds

Don't use getStaticValue function, getStringIfConstant function, and getPropertyName function.

For more information

If you have any questions or comments about this advisory:

Affected versions: >= 1.2.0 < 1.4.1

Commits
  • 4e1bc07 1.4.2
  • e4cb014 🐛 add null test
  • 230a4e2 1.4.1
  • 08158db 🐛 fix getStaticValue security issue
  • 587cca2 🐛 fix getStringIfConstant to handle literals correctly
  • c119e83 🐛 fix getStaticValue to handle bigint correctly
  • 531b16f 🔖 1.4.0
  • 276303d ⚒ upgrade rollup
  • cb518c7 🐛 fix hasSideEffect false negative
  • aac472e 🐛 fix isParenthesized had false positive on ImportExpression (fixes #1)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Pull request limits (per update run and/or open at any time)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

Merge request reports