ESLint - Pluggable JavaScript linter

ESLint v5.7.0 released

Fri, 12 Oct 2018 00:00:00 +0000

ESLint v5.7.0 released

We just pushed ESLint v5.7.0, which is a minor release upgrade of ESLint. This release adds some new features and fixes several bugs found in the previous release.

Highlights

Three rules gained new options in this release:

padding-line-between-statements has a new iife node type to specifically target immediately-invoked function expression invocations as distinct statements.
no-tabs has a new allowIndentationTabs option to permit tabs only for indentation and nowhere else.
camelcase has a new ignoreList option that can be configured to individually allow certain non-camelcase identifiers like React’s UNSAFE_componentWillMount.

Enhancements

6cb63fd Update: Add iife to padding-line-between-statements (fixes #10853) (#10916) (Kevin Partington)
5fd1bda Update: no-tabs allowIndentationTabs option (fixes #10256) (#10925) (Kevin Partington)
066f7e0 Update: camelcase rule ignoreList added (#10783) (Julien Martin)

Bug Fixes

d12be69 Fix: no-extra-bind No autofix if arg may have side effect (fixes #10846) (#10918) (Kevin Partington)
847372f Fix: no-unused-vars false pos. with markVariableAsUsed (fixes #10952) (#10954) (Roy Sutton)
543edfa Fix: Fix error with one-var (fixes #10937) (#10938) (Justin Krup)
5fe0e1a Fix: no-invalid-regexp disallows \ at end of pattern (fixes #10861) (#10920) (Toru Nagashima)

Documentation

95c4cb1 Docs: Fix typo for no-unsafe-finally (#10945) (Sergio Santoro)
f85547a Docs: Add ‘When Not To Use’ section to space-infix-ops (#10931) (Bence Dányi)
3dccac4 Docs: Update working-with-parsers link (#10929) (Azeem Bande-Ali)
557a8bb Docs: Remove old note about caching, add a new one (fixes #10739) (#10913) (Zac)

Dependency Upgrades

70bde69 Upgrade: table to version 5 (#10903) (Rouven Weßling)

Chores

4132de7 Chore: Simplify space-infix-ops (#10935) (Bence Dányi)
fe8111a Chore: Add more test cases to space-infix-ops (#10936) (Bence Dányi)
2e52bca Chore: Update issue templates (#10900) (Nicholas C. Zakas)

ESLint v5.6.1 released

Fri, 28 Sep 2018 00:00:00 +0000

ESLint v5.6.1 released

We just pushed ESLint v5.6.1, which is a patch release upgrade of ESLint. This release fixes several bugs found in the previous release.

Bug Fixes

9b26bdb Fix: avoid exponential require-atomic-updates traversal (fixes #10893) (#10894) (Teddy Katz)
9432b10 Fix: make separateRequires work in consecutive mode (fixes #10784) (#10886) (Pig Fang)
9d52541 Fix: Remove duplicate error message on crash (fixes #8964) (#10865) (Nicholas C. Zakas)

Documentation

d3f3994 Docs: add information about reporting security issues (#10889) (Teddy Katz)
a6ebfd3 Docs: clarify defaultAssignment option, fix no-unneeded-ternary examples (#10874) (CoffeeTableEspresso)
4eb9a49 Docs: Update quotes.md (#10862) (The Jared Wilcurt)
9159e9b Docs: Update complexity.md (#10867) (Szymon Przybylski)
14f4e46 Docs: Use Linter instead of linter in Nodejs API page (#10864) (Nicholas C. Zakas)

Dependency Upgrades

e51868d Upgrade: debug@4 (fixes #10854) (#10887) (薛定谔的猫)

cc458f4 Build: fix failing tests on master (#10890) (Teddy Katz)

Chores

b3e3cb1 Chore: Update debug log name to match filename (#10863) (Nicholas C. Zakas)

ESLint v5.6.0 released

Fri, 14 Sep 2018 00:00:00 +0000

ESLint v5.6.0 released

We just pushed ESLint v5.6.0, which is a minor release upgrade of ESLint. This release adds some new features and fixes several bugs found in the previous release.

Enhancements

c5b688e Update: Added generators option to func-names (fixes #9511) (#10697) (Oscar Barrett)

Bug Fixes

7da36d5 Fix: respect generator function expressions in no-constant-condition (#10827) (Julian Rosse)

Chores

0a65844 Chore: quote enable avoidEscape option in eslint-config-eslint (#10626) (薛定谔的猫)
32f41bd Chore: Add configuration wrapper markdown for the bug report template (#10669) (Iulian Onofrei)

ESLint v5.5.0 released

Fri, 31 Aug 2018 00:00:00 +0000

ESLint v5.5.0 released

We just pushed ESLint v5.5.0, which is a minor release upgrade of ESLint. This release adds some new features and fixes several bugs found in the previous release.

Enhancements

b61d2cd Update: max-params to only highlight function header (#10815) (Ian Obermiller)

Bug Fixes

6e110e6 Fix: camelcase duplicate warning bug (fixes #10801) (#10802) (Julian Rosse)

Documentation

5103ee7 Docs: Add Brackets integration (#10813) (Jan Pilzer)
2824d43 Docs: fix comment placement in a code example (#10799) (Vse Mozhet Byt)
80c8598 Docs: gitignore syntax updates (fixes #8139) (#10776) (Gustavo Santana)

Dependency Upgrades

2b2f11d Upgrade: babel-code-frame to version 7 (#10808) (Rouven Weßling)
10690b7 Upgrade: devdeps and deps to latest (#10622) (薛定谔的猫)

Chores

cb946af Chore: use meta.messages in some rules (1/4) (#10764) (薛定谔的猫)

ESLint v5.4.0 released

Fri, 17 Aug 2018 00:00:00 +0000

ESLint v5.4.0 released

We just pushed ESLint v5.4.0, which is a minor release upgrade of ESLint. This release adds some new features and fixes several bugs found in the previous release.

Enhancements

f3d8454 Update: Improve no-extra-parens error message (#10748) (Timo Tijhof)

Bug Fixes

034690f Fix: no-invalid-meta crashes for non Object values (fixes #10750) (#10753) (Sandeep Kumar Ranka)
562a03f Fix: consistent-docs-url crashes if meta.docs is empty (fixes #10722) (#10749) (Sandeep Kumar Ranka)

Documentation

a70909f Docs: Add jscs-dev.github.io links (#10771) (Gustavo Santana)
11a462d Docs: Broken jscs.info URLs (fixes #10732) (#10770) (Gustavo Santana)

Chores

985567d Chore: rm unused dep string.prototype.matchall (#10756) (薛定谔的猫)
6492233 Chore: enable no-prototype-builtins in codebase (fixes #10660) (#10664) (薛定谔的猫)
137140f Chore: use eslintrc overrides (#10677) (薛定谔的猫)

ESLint v5.3.0 released

Fri, 03 Aug 2018 00:00:00 +0000

ESLint v5.3.0 released

We just pushed ESLint v5.3.0, which is a minor release upgrade of ESLint. This release adds some new features and fixes several bugs found in the previous release.

Highlights

Four new rules have been added:

no-misleading-character-class reports multi-code-point characters in regular expression character classes. Using these characters in character classes often results in surprising behavior.
require-atomic-updates reports potential race conditions that result from updating values in async or generator functions.
no-async-promise-executor reports uses of the Promise constructor that have an async function as the argument. Using an async function in this scenario is not necessary and a potential source of bugs.
require-unicode-regexp requires all regular expressions to have the u flag. Regular expressions with the u flag have stricter parsing rules and handle unicode text more sensibly, which is useful to avoid unexpected behavior when writing regular expressions.

Features

6eb972c New: require-unicode-regexp rule (fixes #9961) (#10698) (Toru Nagashima)
2cc3240 New: add no-misleading-character-class (fixes #10049) (#10511) (Toru Nagashima)
9e93d46 New: add no-async-promise-executor rule (fixes #10217) (#10661) (Teddy Katz)
5a2538c New: require-atomic-updates rule (fixes #10405) (#10655) (Teddy Katz)

Enhancements

e37a593 Update: Fix incorrect default value for position (#10670) (Iulian Onofrei)
f026fe1 Update: Fix ‘function’ in padding-line-between-statements (fixes #10487) (#10676) (Kevin Partington)
9e76be7 Update: indent comments w/ nearby code if no blank lines (fixes #9733) (#10640) (Kevin Partington)

Bug Fixes

5c5d64d Fix: ignored-paths for Windows path (fixes #10687) (#10691) (Toru Nagashima)
d56c39d Fix: ESLint cache no longer stops autofix (fixes #10679) (#10694) (Kevin Partington)
877f4b8 Fix: The “../..” folder is always ignored (fixes #10675) (#10682) (Sridhar)
8b83d2b Fix: always resolve default ignore patterns from CWD (fixes #9227) (#10638) (Teddy Katz)
acb6658 Fix: ESLint crash with prefer-object-spread (fixes #10646) (#10649) (薛定谔的猫)

Documentation

dd6cb19 Docs: Updated no-return-await Rule Documentation (fixes #9695) (#10699) (Marla Foreman)
863aa78 Docs: add another example for when not to use no-await-in-loop (#10714) (Valeri Karpov)
6e78b7d Docs: remove links to terminated jscs.info domain (#10706) (Piotr Kuczynski)
8084bfc Docs: change when not to use object spread (#10621) (Benny Powers)
c2bb8bb Docs: Remove superfluous object option sample code (#10652) (Iulian Onofrei)
d34a13b Docs: add subheader in configuring/configuring-rules (#10686) (薛定谔的猫)
99fb7d3 Docs: fix misleading no-prototype-builtins description (#10666) (薛定谔的猫)
005b849 Docs: fix outdated description of baseConfig option (#10657) (Teddy Katz)
15a77c4 Docs: fix broken links (fixes eslint/eslint-jp#6) (#10658) (Toru Nagashima)
87cd344 Docs: Make marking a default option consistent with other rules (#10650) (Iulian Onofrei)
b6daf0e Docs: Remove superfluous section from no-unsafe-negation (#10648) (Iulian Onofrei)

5f6a765 Build: ensure URL fragments remain in documentation links (fixes #10717) (#10720) (Teddy Katz)

Chores

6009239 Chore: rename utils for consistency (#10727) (薛定谔的猫)
5984820 Chore: Move lib/file-finder.js to lib/util/ (refs #10559) (#10695) (Kevin Partington)
7f496e2 Chore: Update require path for ast-utils (#10693) (Kevin Partington)
648a33a Chore: reorganize code structure of utilities (refs #10599) (#10680) (薛定谔的猫)
d8aea28 Chore: rm unnecessary plugin in eslint-config-eslint (#10685) (薛定谔的猫)
0cb5e3e Chore: Replace some function application with spread operators (#10645) (Kevin Partington)
e1a3cac Chore: rm deprecated experimentalObjectRestSpread option in tests (#10647) (薛定谔的猫)

ESLint v5.2.0 released

Fri, 20 Jul 2018 00:00:00 +0000

ESLint v5.2.0 released

We just pushed ESLint v5.2.0, which is a minor release upgrade of ESLint. This release adds some new features and fixes several bugs found in the previous release.

Highlights

When using the --cache flag, the results for files with linting errors are now saved to the cache. This should result in improved performance when using --cache on a codebase with existing linting errors.

Enhancements

81283d0 Update: Cache files that failed linting (fixes #9948) (#10571) (Kevin Partington)

Documentation

9f93d5f Docs: Updated Working with Custom Formatters (fixes #9950) (#10592) (Marla Foreman)

Dependency Upgrades

13cc63e Upgrade: ignore@4.0.2 (#10619) (Rouven Weßling)
761f802 Upgrade: eslint-plugin-node to 7.0.1 (#10612) (Toru Nagashima)

c517b2a Build: fix npm run perf failing(fixes #10577) (#10607) (薛定谔的猫)
80b296e Build: package.json update for eslint-config-eslint release (ESLint Jenkins)
64dfa21 Build: Fix prerelease logic in blog post generation (fixes #10578) (#10581) (Kevin Partington)

Chores

ac77a80 Chore: Fixing a call to Object.assign.apply in Linter (#10629) (Kevin Partington)
e596939 Chore: fix redundant equality check (#10617) (Toru Nagashima)
9aaf195 Chore: Extract lint result cache logic (refs #9948) (#10562) (Kevin Partington)
e4e7ff2 Chore: fix error message in eslint-config-eslint (#10588) (薛定谔的猫)
1e88170 Chore: Move lib/logging and lib/timing to lib/util/ (refs #10559) (#10579) (Kevin Partington)
0faf633 Chore: Simplify helper method in Linter tests (#10580) (Kevin Partington)

Postmortem for Malicious Packages Published on July 12th, 2018

Thu, 12 Jul 2018 00:00:00 +0000

Postmortem for Malicious Packages Published on July 12th, 2018

Summary

On July 12th, 2018, an attacker compromised the npm account of an ESLint maintainer and published malicious versions of the eslint-scope and eslint-config-eslint packages to the npm registry. On installation, the malicious packages downloaded and executed code from pastebin.com which sent the contents of the user’s .npmrc file to the attacker. An .npmrc file typically contains access tokens for publishing to npm.

The malicious package versions are eslint-scope@3.7.2 and eslint-config-eslint@5.0.2, both of which have been unpublished from npm. The pastebin.com paste linked in these packages has also been taken down.

npm has revoked all access tokens issued before 2018-07-12 12:30 UTC. As a result, all access tokens compromised by this attack should no longer be usable.

The maintainer whose account was compromised had reused their npm password on several other sites and did not have two-factor authentication enabled on their npm account.

We, the ESLint team, are sorry for allowing this to happen. We hope that other package maintainers can learn from our mistakes and improve the security of the whole npm ecosystem.

Affected Packages

eslint-scope@3.7, a scope analysis library, is a dependency of several popular packages, including some older versions of eslint and the latest versions of babel-eslint and webpack.
eslint-config-eslint@5.0 is a configuration used internally by the ESLint team, with very little usage elsewhere.

If you run your own npm registry, you should unpublish the malicious versions of each package. They have already been unpublished from the npmjs.com registry.

Attack Method

Further details on the attack can be found here.

Recommendations

With the hindsight of this incident, we have a few recommendations for npm package maintainers and users in the future:

Package maintainers and users should avoid reusing the same password across multiple different sites. A password manager like 1Password or LastPass can help with this.
Package maintainers should enable npm two-factor authentication. npm has a guide here.
- If you use Lerna, you can follow this issue.
Package maintainers should audit and limit the number of people who have access to publish on npm.
Package maintainers should be careful with using any services that auto-merge dependency upgrades.
Application developers should use a lockfile (package-lock.json or yarn.lock) to prevent the auto-install of new packages.

Timeline

Before the incident: The attacker presumably found the maintainer’s reused email and password in a third-party breach and used them to log in to the maintainer’s npm account.
Early morning July 12th, 2018: The attacker generated an authentication token in the maintainer’s npm account.
2018-07-12 9:49 UTC: The attacker used the generated authentication token to publish eslint-config-eslint@5.0.2, which contained a malicious postinstall script that attempts to exfiltrate the local machine’s .npmrc authentication token.
2018-07-12 10:25 UTC: The attacker unpublished eslint-config-eslint@5.0.2.
2018-07-12 10:40 UTC: The attacker published eslint-scope@3.7.2, which contained the same malicious postinstall script.
2018-07-12 11:17 UTC: A user posted eslint/eslint-scope#39, notifying the ESLint team of the issue.
2018-07-12 12:27 UTC: The pastebin.com link containing malicious code was taken down.
2018-07-12 12:37 UTC: The npm team unpublished eslint-scope@3.7.2 after being contacted by an ESLint maintainer.
2018-07-12 17:41 UTC: The ESLint team published eslint-scope@3.7.3 with the code from eslint-scope@3.7.1 so that caches could pick up the new version.
2018-07-12 18:42 UTC: npm revoked all access tokens generated before 2018-07-12 12:30 UTC.

ESLint v5.1.0 released

Sun, 08 Jul 2018 00:00:00 +0000

ESLint v5.1.0 released

We just pushed ESLint v5.1.0, which is a minor release upgrade of ESLint. This release adds some new features and fixes several bugs found in the previous release.

Highlights

The no-catch-shadow rule has been deprecated in favor of no-shadow.

Enhancements

143890a46 Update: Adjust grammar of error/warnings fixable (#10546) (Matt Mischuk)
b7addf6fe Update: deprecate no-catch-shadow (fixes #10466) (#10526) (Toru Nagashima)

Bug Fixes

b2df73876 Fix: prefer-object-spread duplicated comma (fixes #10512, fixes #10532) (#10524) (Toru Nagashima)
d8c3a25f5 Fix: wrap-regex doesn’t work in some expression(fixes #10573) (#10576) (薛定谔的猫)
63f36f783 Fix: sort-keys in an object that contains spread (fixes #10261) (#10495) (katerberg)
601a5c4ae Fix: Prefer-const rule crashing on array destructuring (fixes #10520) (#10527) (Michael Mason)
02efeac65 Fix: do not fail on nested unknown operators (#10561) (Rubén Norte)
e862dc3a8 Fix: Remove autofixer for no-debugger (fixes #10242) (#10509) (Teddy Katz)

Documentation

114f42ee5 Docs: Clarify option defaults in max-lines-per-function docs (#10569) (Chris Harwood)
100f1beb2 Docs: add note about release issues to readme (#10572) (Teddy Katz)
076a6b6db Docs: add actionable fix to no-irregular-whitespace (#10558) (Matteo Collina)
de663ec14 Docs: Only successfully linted files are cached (fixes #9802) (#10557) (Kevin Partington)
8a2ff2c2e Docs: adding a section about disable rules for some files (#10536) (Wellington Soares)
f22a3f80a Docs: fix a word in no-implied-eval (#10539) (Dan Homola)
20d8bbd49 Docs: add missing paragraph about “custom parsers” (#10547) (Pig Fang)

Dependency Upgrades

f0e22fc05 Upgrade: globals@11.7.0 (#10497) (薛定谔的猫)

7328f9918 Build: package.json update for eslint-config-eslint release (ESLint Jenkins)
b161f6b62 Build: Include prerelease install info in release blog post (#10463) (Kevin Partington)

Chores

8ee39c5f2 Chore: small refactor config-validator (#10565) (薛定谔的猫)
92b19ca61 Chore: use eslintrc overrides(dogfooding) (#10566) (薛定谔的猫)

ESLint v5.0.1 released

Mon, 25 Jun 2018 00:00:00 +0000

ESLint v5.0.1 released

We just pushed ESLint v5.0.1, which is a patch release upgrade of ESLint. This release fixes several bugs found in the previous release.

Bug Fixes

196c102 Fix: valid-jsdoc should allow optional returns for async (fixes #10386) (#10480) (Mark Banner)

Documentation

4c823bd Docs: Fix max-lines-per-function correct code’s max value (#10513) (Rhys Bower)

ESLint - Pluggable JavaScript linter

ESLint v5.7.0 released

ESLint v5.7.0 released

Highlights

Enhancements

Bug Fixes

Documentation

Dependency Upgrades

Chores

ESLint v5.6.1 released

ESLint v5.6.1 released

Bug Fixes

Documentation

Dependency Upgrades

Build Related

Chores

ESLint v5.6.0 released

ESLint v5.6.0 released

Enhancements

Bug Fixes

Chores

ESLint v5.5.0 released

ESLint v5.5.0 released

Enhancements

Bug Fixes

Documentation

Dependency Upgrades

Chores

ESLint v5.4.0 released

ESLint v5.4.0 released

Enhancements

Bug Fixes

Documentation

Chores

ESLint v5.3.0 released

ESLint v5.3.0 released

Highlights

Features

Enhancements

Bug Fixes

Documentation

Build Related

Chores

ESLint v5.2.0 released

ESLint v5.2.0 released

Highlights

Enhancements

Documentation

Dependency Upgrades

Build Related

Chores

Postmortem for Malicious Packages Published on July 12th, 2018

Postmortem for Malicious Packages Published on July 12th, 2018

Summary

Affected Packages

Attack Method

Recommendations

Timeline

Links

ESLint v5.1.0 released

ESLint v5.1.0 released

Highlights

Enhancements

Bug Fixes

Documentation

Dependency Upgrades

Build Related

Chores

ESLint v5.0.1 released

ESLint v5.0.1 released

Bug Fixes

Documentation