Bug
CI's `Security baseline` job (`node scripts/security-audit.mjs`) currently fails on `main`,
independent of any specific PR — confirmed by checking `main`'s own CI run directly.
Root cause
`npm audit` reports 5 high-severity advisories, all tracing to a single root: a DoS/ReDoS bug in
`brace-expansion`, pulled in via `eslint@9.39.5` -> `minimatch` -> `brace-expansion`:
```
@eslint/config-array - high - via minimatch
@eslint/eslintrc - high - via minimatch
brace-expansion - high - DoS via exponential-time / unbounded expansion
eslint - high - via config-array, eslintrc, minimatch
minimatch - high - via brace-expansion
```
`npm audit`'s only reported fix is `eslint@10.8.0` (`isSemVerMajor: true`) — no patched 9.x release
exists upstream.
`eslint` is a `devDependency` only (never installed by `npm install rstack-agents`), so this does
not affect anyone consuming the published package — but the CI gate is red on `main` right now,
which is a real, unaddressed problem regardless.
Fix
Bump `eslint` to `^10.0.0`. The repo already uses ESLint's flat config (`eslint.config.js`),
which is compatible across the 9->10 boundary, so no config rewrite needed. Verify `npm run lint`
still passes with the same signal (0 errors, same pre-existing warnings) and `npm audit` clears
the high-severity findings.
PR incoming.
Bug
CI's `Security baseline` job (`node scripts/security-audit.mjs`) currently fails on `main`,
independent of any specific PR — confirmed by checking `main`'s own CI run directly.
Root cause
`npm audit` reports 5 high-severity advisories, all tracing to a single root: a DoS/ReDoS bug in
`brace-expansion`, pulled in via `eslint@9.39.5` -> `minimatch` -> `brace-expansion`:
```
@eslint/config-array - high - via minimatch
@eslint/eslintrc - high - via minimatch
brace-expansion - high - DoS via exponential-time / unbounded expansion
eslint - high - via config-array, eslintrc, minimatch
minimatch - high - via brace-expansion
```
`npm audit`'s only reported fix is `eslint@10.8.0` (`isSemVerMajor: true`) — no patched 9.x release
exists upstream.
`eslint` is a `devDependency` only (never installed by `npm install rstack-agents`), so this does
not affect anyone consuming the published package — but the CI gate is red on `main` right now,
which is a real, unaddressed problem regardless.
Fix
Bump `eslint` to `^10.0.0`. The repo already uses ESLint's flat config (`eslint.config.js`),
which is compatible across the 9->10 boundary, so no config rewrite needed. Verify `npm run lint`
still passes with the same signal (0 errors, same pre-existing warnings) and `npm audit` clears
the high-severity findings.
PR incoming.