Search code, repositories, users, issues, pull requests...

Bug Fixes

253be16 fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)

Documentation

74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)
eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)

Chores

458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077) (Francesco Trotta)
202117b chore: package.json update for @eslint/js release (Jenkins)
d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21074) (Francesco Trotta)
7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068) (Milos Djermanovic)
daf7791 chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)
daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#20829) (Milos Djermanovic)
116d4be ci: unpin Node.js 25.x in CI (#20619) (Copilot)

`v9.39.4`

Bug Fixes

f18f6c8 fix: update dependency minimatch to ^3.1.5 (#20564) (Milos Djermanovic)
a3c868f fix: update dependency @eslint/eslintrc to ^3.3.4 (#20554) (Milos Djermanovic)
234d005 fix: minimatch security vulnerability patch for v9.x (#20549) (Andrej Beles)
b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#20538) (루밀LuMir)

Documentation

4675152 docs: add deprecation notice partial (#20520) (Milos Djermanovic)

Chores

b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#20596) (Francesco Trotta)
71b2f6b chore: package.json update for @eslint/js release (Jenkins)
1d16c2f ci: pin Node.js 25.6.1 (#20563) (Milos Djermanovic)

`v9.39.3`

Bug Fixes

791bf8d fix: restore TypeScript 4.0 compatibility in types (#20504) (sethamus)

Chores

8594a43 chore: upgrade @eslint/js@9.39.3 (#20529) (Milos Djermanovic)
9ceef92 chore: package.json update for @eslint/js release (Jenkins)
af498c6 chore: ignore /docs/v9.x in link checker (#20453) (Milos Djermanovic)

mochajs/mocha (mocha)

`v11.7.6`

🩹 Fixes

make describe().timeout() work (aafe6fd)
test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

format all code (#5629) (0696784)
remove Netlify (#5630) (8d01d33)

websockets/ws (ws)

`v8.21.1`

Bug fixes

Empty fragments are now counted toward the limit (a2f4e7c).
The default values of the maxBufferedChunks and maxFragments options have
been reduced (f197ac6).

`v8.21.0`

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd4).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd4).

A high volume of tiny fragments and data chunks could be sent by a peer, using
modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`server close - code: ${code} reason: ${reason.toString()}`);
  });
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the
maxPayload option if possible.

`v8.20.1`

Bug fixes

Fixed an uninitialized memory disclosure issue in websocket.close()
(c0327ec).

Providing a TypedArray (e.g. Float32Array) as the reason argument for
websocket.close(), rather than the supported string or Buffer types, caused
uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

`v8.20.0`

Features

Added exports for the PerMessageDeflate class and utilities for the
Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1).

`v8.19.0`

Features

Added the closeTimeout option (#2308).

Bug fixes

Handled a forthcoming breaking change in Node.js core (1998485).

Configuration

📅 Schedule: (in timezone Asia/Calcutta)

Branch creation
- "before 3am on the first day of the month"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sonarqubecloud · 2026-03-27T12:40:46Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-04-29T16:32:04Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-06-01T21:40:08Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-07-30T17:16:27Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code