Skip to content

🚨 [security] Update eslint-config-prettier 8.10.0 → 10.1.8 (major) #369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: legacy
Choose a base branch
from
Open

🚨 [security] Update eslint-config-prettier 8.10.0 → 10.1.8 (major) #369

wants to merge 1 commit into from

Conversation

@depfu
Copy link
Contributor

@depfu depfu bot commented Jul 25, 2025

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ eslint-config-prettier (8.10.0 → 10.1.8) · Repo · Changelog

Security Advisories 🚨

🚨 eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

🚨 eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

🚨 eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

Release Notes

10.1.8

republish latest version

Full Changelog: v10.1.5...v10.1.8

10.1.5

Patch Changes

Full Changelog: v10.1.4...v10.1.5

10.1.4

Patch Changes

Full Changelog: v10.1.3...v10.1.4

10.1.3

Patch Changes

New Contributors

Full Changelog: v10.1.2...v10.1.3

10.1.2

Patch Changes

  • #321 a8768bf Thanks @Fdawgs! - chore(package): add homepage for some 3rd-party registry - see #321 for more details

10.1.1

Patch Changes

  • #309 eb56a5e Thanks @JounQin! - fix: separate the /flat entry for compatibility

    For flat config users, the previous "eslint-config-prettier" entry still works, but "eslint-config-prettier/flat" adds a new name property for config-inspector, we just can't add it for the default entry for compatibility.

    See also #308

    // before
import eslintConfigPrettier from "eslint-config-prettier";

    // after
    
import eslintConfigPrettier from "eslint-config-prettier/flat";

10.1.0

Minor Changes

10.0.3

Patch Changes

New Contributors

Full Changelog: v10.0.2...v10.0.3

10.0.2

Patch Changes

10.0.1

eslint-config-prettier

10.0.1

What's Changed

  • chore: migrate to changeset for automatically releasing by @JounQin in #278
  • add support for @stylistic/eslint-plugin by @abrahamguo in #272

New Contributors

Full Changelog: v9.1.0...v10.0.1

9.1.0 (from changelog)

9.0.0 (from changelog)

  • Added: The CLI helper tool now works with eslint.config.js (flat config). Just like ESLint itself, the CLI tool automatically first tries eslint.config.js and then eslintrc, and you can force which one to use by setting the ESLINT_USE_FLAT_CONFIG environment variable. Note that the config of eslint-config-prettier has always been compatible with eslint.config.js (flat config) – it was just the CLI tool that needed updating. On top of that, the docs have been updated to mention how to use both eslint.config.js (flat config) and eslintrc, and the tests now test both config systems.
  • Changed: unicode-bom is no longer turned off. Prettier preserves the BOM if you have one, and does not add one if missing. It was wrong of eslint-config-prettier to disable that rule. If you get ESLint errors after upgrading, either add "unicode-bom": "off" to your config to disable it again, or run ESLint with --fix to fix all files according to the rule (add or remove BOM). Thanks to Nicolas Stepien (@nstepien)!

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 53 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added dependencies Pull requests that update a dependency file depfu labels Jul 25, 2025
@depfu depfu bot mentioned this pull request Jul 25, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file depfu

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant