The practical consequences of running an outdated eslint version are, for most projects, zero. The cost of upgrading is non zero. So upgrading only happens when there's a compelling reason to update like:
- A real security issue - things like the reDoS example cited are part of the crying wolf that causes people to treat security scanners less seriously
- A new feature (lint rule in eslint's case, or maybe new JS syntax support) is desired. The new upgrade can be deferred until that time
- You're doing updates _anyway_ and update eslint as part of that housekeeping.
- There's a bug in one of the linters that is giving false positives (passing good code or missing bad code). This may not be a security issue, it may just result in poor code quality.
1. How often are security issues found that are already fixed compared to security issues that are still in the latest version and require an even newer version to fix?
2. What are the security issues that can be found in a local tool which has as its only input your own code and it's output is only printed in tooltips for human review? Even if you had a way for specially formed code to run other code in eslint, it's a bit like saying bash has an RCE because you can type a command into it.
Comments
The practical consequences of running an outdated eslint version are, for most projects, zero. The cost of upgrading is non zero. So upgrading only happens when there's a compelling reason to update like:
- A real security issue - things like the reDoS example cited are part of the crying wolf that causes people to treat security scanners less seriously
- A new feature (lint rule in eslint's case, or maybe new JS syntax support) is desired. The new upgrade can be deferred until that time
- You're doing updates _anyway_ and update eslint as part of that housekeeping.
- There's a bug in one of the linters that is giving false positives (passing good code or missing bad code). This may not be a security issue, it may just result in poor code quality.
But do you really want to wait for a real security issue to emerge? Seems like keeping things updated is a simple, smart form of insurance.
1. How often are security issues found that are already fixed compared to security issues that are still in the latest version and require an even newer version to fix?
2. What are the security issues that can be found in a local tool which has as its only input your own code and it's output is only printed in tooltips for human review? Even if you had a way for specially formed code to run other code in eslint, it's a bit like saying bash has an RCE because you can type a command into it.