[Snyk] Security upgrade eslint from 8.29.0 to 9.0.0

[karencapiiro]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• website/package.json
• website/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncontrolled Recursion SNYK-JS-FLATTED-15518041	170

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[karencapiiro]

This is a major version upgrade to ESLint v9 which introduces significant breaking changes, most notably the move to a new default configuration file format.

Key Breaking Changes:

• New Default Config Format: ESLint now defaults to a new "flat config" file named eslint.config.js. The traditional .eslintrc file format is deprecated and will not be used unless you set the ESLINT_USE_FLAT_CONFIG=false environment variable. [1, 2, 3]
• Node.js Version Requirement: Support for Node.js versions older than v18.18.0 and all of v19 has been dropped. [1, 2, 4]
• Removed Rules and Formatters: The valid-jsdoc and require-jsdoc rules have been removed. [1, 2] Additionally, several core formatters (including checkstyle, compact, and junit) have been removed, leaving only stylish, html, json, and json-with-meta. [2]
• Behavioral Changes: The --quiet command-line flag now skips executing rules set to "warn" entirely, instead of just hiding their output. [1, 2]

Source: ESLint v9 Migration Guide

Recommendation: This upgrade requires a mandatory migration of your configuration file from the old .eslintrc format to the new eslint.config.js format. Review the official migration guide and consider using the provided migration script (npx @eslint/migrate-config) to assist with the conversion. [1, 8]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​starlette@​0.22.0
	npm/​eslint@​8.29.0 ⏵ 9.0.0			+1	+47
	pypi/​uvicorn@​0.20.0
	pypi/​typer@​0.7.0
	pypi/​sqlmodel@​0.0.8

View full report

[karencapiiro]

Checkmarx One – Scan Summary & Details – 0e9b8896-d380-4899-8b36-c91af6e881a9

---

New Issues (11)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2025-14874	Npm-nodemailer-6.8.0	details Recommended version: 7.0.11 Description: A flaw was found in Nodemailer versions through 7.0.10. This vulnerability allows a Denial-of-Service (DoS) via a crafted email address header that... Attack Vector: NETWORK Attack Complexity: LOW ID: xi0XTRMAtlytELhVt%2BY4rYmUs4YYzsVpGEOlxqta45I%3D Vulnerable Package
2		CVE-2025-59471	Npm-next-13.0.6	details Recommended version: 15.5.10 Description: A Denial-of-Service (DoS) vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. T... Attack Vector: NETWORK Attack Complexity: LOW ID: PDFuDU2XEek%2FEoyv3GoBP1HnoGKdecpkCwt3Cj%2FEorU%3D Vulnerable Package
3		CVE-2025-66418	Python-urllib3-1.26.20	details Recommended version: 2.6.3 Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression ch... Attack Vector: NETWORK Attack Complexity: LOW ID: N0doRvUgN39Gta90UKSzZPW491bd7Z0MFtODLhZxZdU%3D Vulnerable Package
4		CVE-2026-21441	Python-urllib3-1.26.20	details Recommended version: 2.6.3 Description: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the... Attack Vector: NETWORK Attack Complexity: LOW ID: UPtiYb7PrlZaMcbei%2FqzqObRVB96d%2Bnl60luqJjJzWg%3D Vulnerable Package
5		CVE-2026-25639	Npm-axios-1.2.1	details Recommended version: 1.13.5 Description: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.13.5, the mergeConfig function in axios crashes with a TypeError when ... Attack Vector: NETWORK Attack Complexity: LOW ID: qv1KsPIt7%2Bof%2FBy1dCiBcBY5Ce%2Ft63ln23ktyUW6zK0%3D Vulnerable Package
6		Cxee52a55a-f23b	Npm-next-13.0.6	details Recommended version: 15.5.10 Description: A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packa... Attack Vector: NETWORK Attack Complexity: LOW ID: BuxID08SB0Q1LwdRNqq6CzavrwM2vK%2BHE%2BUc1z9iWz8%3D Vulnerable Package
7		Passwords And Secrets - Generic Secret	/docker-compose.yaml: 48	details Query to find passwords and secrets in infrastructure code. ID: XS6TYNn5u0g7jTiGz3BylPry9U8%3D
8		Memory Not Limited	/docker-compose.yaml: 4	details Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ... ID: MzPZ0jTiyuQtT%2B81zlRApkCYJhc%3D
9		Memory Not Limited	/docker-compose.yaml: 19	details Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than ... ID: %2BbHqyR84xogGtgL5Cneja4uDtDo%3D
10		Cpus Not Limited	/docker-compose.yaml: 19	details CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests ID: mnLPenoxG1clW%2ByxvCAvcWPZnbQ%3D
11		Cpus Not Limited	/docker-compose.yaml: 4	details CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests ID: mfmN5pFEUJC48DomKryTCnm7lkY%3D

---

Fixed Issues (7)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2022-46175	Npm-json5-1.0.1
	CVE-2023-26115	Npm-word-wrap-1.2.3
	CVE-2025-64718	Npm-js-yaml-4.1.0
	Memory Not Limited	/docker-compose.yaml: 19
	Memory Not Limited	/docker-compose.yaml: 4
	Cpus Not Limited	/docker-compose.yaml: 19
	Cpus Not Limited	/docker-compose.yaml: 4

---

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

[jit-ci]

🛡️ Jit Security Scan Results

🚨 Summary

• High severity ReDoS vulnerability detected in cross-spawn package

• Vulnerability introduced through eslint dependency

• Upgrade of eslint package recommended to address the issue

🔍 Findings

HIGH - 1 finding

1. ReDoS Vulnerability in cross-spawn Package

ID	Type	Finding	File	Severity
5385f444b9	GHSA-3xgq-45jj-v275	ReDoS Vulnerability in cross-spawn Package - A high severity Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package. This issue is introduced through the eslint dependency.	website/package.json (lines 25-25)	HIGH

🔍 AI Analysis: This is a high severity vulnerability that could lead to denial of service attacks, potentially affecting the entire application's performance.

Remediation:

- "eslint": "9.0.0",
+ "eslint": "^9.0.5",

▶️ Advanced Options

Help section with supported ignore actions and syntax.

Need to ignore a finding? Use commands like:

@sera ignore <finding_id> reason:accepted (reason is optional)

@sera ignore all reason:other - this is a test PR (reason is optional)

@sera ignore type:GHSA-3xgq-45jj-v275

---

^{Security scan by Jit}