Skip to content

fix: patch @eslint/plugin-kit ReDoS vulnerability (GHSA-xffm-g5w8-qvg7) #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jobenjada wants to merge 1 commit into from
Closed

fix: patch @eslint/plugin-kit ReDoS vulnerability (GHSA-xffm-g5w8-qvg7) #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,16 @@
"turbo": "^2.5.8",
"typescript": "5.9.3"
},
"pnpm": {
"overrides": {
"@eslint/[email protected]": "0.4.0"
},
Comment on lines +20 to +21
Copy link

@coderabbitai coderabbitai bot Oct 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Override pattern doesn't hit ESLint's dependency range.

[email protected] declares @eslint/plugin-kit with the range ^0.2.8, so pnpm will keep resolving 0.2.x. An override key of @eslint/[email protected] only matches requests that exactly require 0.2.8, meaning this override never fires and the vulnerable version stays in the tree. Please switch the key to cover the whole package (e.g. @eslint/plugin-kit: 0.4.0 or @eslint/plugin-kit@*: 0.4.0) so pnpm force-resolves the patched release.

Apply this diff:

-    "overrides": {
-      "@eslint/[email protected]": "0.4.0"
-    },
+    "overrides": {
+      "@eslint/plugin-kit": "0.4.0"
+    },
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"@eslint/[email protected]": "0.4.0"
},
"overrides": {
"@eslint/plugin-kit": "0.4.0"
},
🤖 Prompt for AI Agents 
In package.json around lines 20 to 21, the override key
"@eslint/[email protected]" only matches an exact version and therefore doesn't
override the ^0.2.8 range that eslint depends on; change the override key to
cover the package range (for example use "@eslint/plugin-kit": "0.4.0" or
"@eslint/plugin-kit@*": "0.4.0") so pnpm will force-resolve all requests for
@eslint/plugin-kit to the patched 0.4.0 release.

"comments": {
"overrides": {
"@eslint/plugin-kit": "Security fix for GHSA-xffm-g5w8-qvg7 (ReDoS vulnerability). Using override instead of updating eslint to avoid updating all other eslint dependencies. [email protected] uses @eslint/[email protected] (vulnerable), but 0.4.0 is backward compatible."
}
}
},
"packageManager": "[email protected]",
"engines": {
"node": ">=18"
Expand Down
21 changes: 16 additions & 5 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.