Bump @eslint/js from 9.39.0 to 9.39.1 #239
Conversation
Bumps [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) from 9.39.0 to 9.39.1. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v9.39.1/packages/js) --- updated-dependencies: - dependency-name: "@eslint/js" dependency-version: 9.39.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
|
|
✓ Safe to upgradeI recommend merging this upgrade because it's a patch release that fixes critical bugs including crashes with TypeScript ESLint rules. The upgrade is from a development-only linting dependency with no breaking changes, and the reported malicious packages are unrelated typosquatting attacks on different package names that are not present in this project. The project does not use the affected unified-signatures rule, so this upgrade provides stability improvements without introducing any risks. What we checked
Dependency UsageThe @eslint/js package is used exclusively in the project's linting infrastructure, specifically within the ESLint configuration file where it provides the base recommended and all-rules configurations that serve as the foundation for the project's code quality standards. This development-time dependency enables the FOSSA Action GitHub project to enforce consistent TypeScript and JavaScript coding standards across the codebase, supporting code quality and maintainability for this license compliance and security scanning tool. The package follows a standard architectural pattern where build-time tooling is isolated to configuration files and npm scripts, ensuring zero runtime dependencies for the production application.
ChangesThis update to @eslint/js fixes a bug where incorrect data was being passed to JavaScript language visitor methods, correcting the visitor API contract. The package also adds CI improvements for dependency management and documentation updates for configuration best practices.
View 11 more changes
References (4)[1]: Dependency upgraded from ^9.39.0 to ^9.39.1 - patch version bump indicating bug fixes only Line 20 in 833c481 [2]: Package is imported and used only for ESLint configuration (js.configs.recommended and js.configs.all), confirming development-time only usage fossa-action/eslint.config.mjs Line 10 in 833c481 [3]: Official ESLint release notes confirm this is a bug fix release addressing crashes with TypeScript ESLint unified-signatures rule (source link) [4]: Project does not use the unified-signatures rule that was causing crashes in 9.39.0, so the bug did not affect this codebase fossabot analyzed this PR using dependency research. |
Bumps @eslint/js from 9.39.0 to 9.39.1.
Release notes
Sourced from
@eslint/js's releases.Commits
c7ebefcchore: package.json update for@eslint/jsreleaseDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)