[Snyk] Security upgrade eslint from 8.11.0 to 9.0.0

[earthiverse]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	436

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[gemini-code-assist]

Summary of Changes

Hello @earthiverse, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request, automatically generated by Snyk, is a crucial security update for the project's npm dependencies. Its primary purpose is to upgrade the eslint package to its latest major version, 9.0.0, thereby mitigating an identified Regular Expression Denial of Service (ReDoS) vulnerability. This upgrade also involves a comprehensive refresh of the dependency tree, with many sub-dependencies being updated, added, or removed to align with the new eslint requirements.

Highlights

• Security Upgrade: Upgraded the eslint development dependency from version 8.11.0 to 9.0.0 to address a critical Regular Expression Denial of Service (ReDoS) vulnerability (SNYK-JS-BRACEEXPANSION-9789073).
• Major Version Bump: This is a major version upgrade for eslint, which typically includes breaking changes and significant updates to its ecosystem, reflected in the extensive changes to package-lock.json.
• Transitive Dependency Updates: The package-lock.json file reflects a substantial number of transitive dependency updates, additions, and removals, ensuring compatibility with the new eslint version and improving overall project security and stability.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request upgrades ESLint from v8 to v9 to address a security vulnerability. This is a major version upgrade and introduces several significant breaking changes that could impact the project.

Key points to consider before merging:

• Node.js Version Requirement: ESLint v9 requires Node.js ^18.18.0, ^20.9.0, or >=21.1.0. Please ensure your development and CI/CD environments meet this requirement.
• Configuration File Migration: ESLint v9 defaults to a new "flat" configuration format (eslint.config.js). The traditional .eslintrc.* format is deprecated. If your project uses the older format, you will need to migrate your configuration.
• Rule and API Changes: Several core rules have been changed or removed, and APIs for custom rules/plugins have been updated.

I've added a more detailed comment in package.json. It is highly recommended to review the ESLint v9 Migration Guide to understand the full scope of these changes and ensure a smooth transition.

[gemini-code-assist]

Upgrading to ESLint v9 is a major change with several breaking changes that need to be addressed.

1. Node.js Version: ESLint v9 requires Node.js ^18.18.0, ^20.9.0, or >=21.1.0. Your project's engines field in package.json (if present) and your CI/CD environment configurations should be updated accordingly. Failure to do so will likely break your build.

2. Configuration Format: ESLint v9 now uses a "flat config" (eslint.config.js) by default, and the legacy .eslintrc.* format is deprecated. If you are using the old format, you will need to migrate. You can temporarily opt-out and continue using your .eslintrc.js file by setting ESLINT_USE_FLAT_CONFIG=false in your environment, but migration is recommended for long-term support.

3. Removed/Changed Rules: Some rules have been removed (e.g., valid-jsdoc) or had their defaults changed. This could lead to new linting errors or different behavior.

Please consult the official ESLint v9 Migration Guide for a comprehensive list of changes and migration steps.

[gemini-code-assist]

This dependency, @humanwhocodes/config-array, is now deprecated as part of the ESLint v9 update. The suggested replacement is @eslint/config-array.

While this doesn't break the build now, it's a good idea to be aware of this for future maintenance and eventually migrate away from the deprecated package.

[gemini-code-assist]

Similar to other packages from @humanwhocodes, this dependency, @humanwhocodes/object-schema, is now deprecated. The suggested replacement is @eslint/object-schema.

This is for your information to aid future maintenance.