Bump @eslint/eslintrc from 3.3.6 to 3.3.7

[dependabot]

Bumps @eslint/eslintrc from 3.3.6 to 3.3.7.

Release notes

Sourced from @​eslint/eslintrc's releases.

eslintrc: v3.3.7

3.3.7 (2026-09-01)

Bug Fixes

• Bump js-yaml to 4.3.1 (#239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#243) (bb0d97a)

Changelog

Sourced from @​eslint/eslintrc's changelog.

3.3.7 (2026-09-01)

Bug Fixes

• Bump js-yaml to 4.3.1 (#239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#243) (bb0d97a)

Commits

• 7943fa6 chore: release 3.3.7 🚀 (#240)
• bb0d97a fix: update js-yaml to 4.3.2 to address security vulnerability (#243)
• 5b4abc9 docs: Update README sponsors
• f27e7c9 fix: Bump js-yaml to 4.3.1 (#239)
• b75e1d2 docs: Update README sponsors
• 302c133 docs: Update README sponsors
• e62e766 docs: Update README sponsors
• cf27f9f docs: Update README sponsors
• c7f4cdf docs: Update README sponsors
• 3319822 docs: Update README sponsors
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[fossabot]

✓ Safe to upgrade

I recommend merging this upgrade because it is a minimal patch release of @​eslint/eslintrc that bumps an internal js-yaml transitive dependency to address a security vulnerability, with no API or behavioral changes. The package is consumed exclusively as a devDependency in eslint.config.mjs to instantiate FlatCompat, meaning it has zero presence in runtime or production code. No breaking changes, deprecations, or incompatibilities were detected. The noted runtime version context (project on Node 24, package engine field targeting older Node versions) is not a concern since Node 24 is fully backwards-compatible with packages declaring minimum engines of Node 18/20/21.

What we checked

• The package is declared as a devDependency at ^3.3.7, confirming this upgrade is entirely scoped to developer tooling and does not affect production runtime behavior. ^[1]
• The sole usage of @​eslint/eslintrc in the codebase is a single FlatCompat import. The public API surface used (FlatCompat constructor and .extends()) is unchanged in this patch release, so no code changes are required. ^[2]
• FlatCompat is instantiated with baseDirectory, recommendedConfig, and allConfig — all standard constructor options that are unaffected by the internal js-yaml dependency bump introduced in this patch. ^[3]
• The only change in this release is updating the internal js-yaml dependency from ^4.3.0 to ^4.3.2 to address a security vulnerability in YAML parsing. This is an internal implementation detail with no API surface impact on consumers of @​eslint/eslintrc. ^[4]

Dependency Usage

@​eslint/eslintrc is used exclusively within the developer tooling layer — specifically in eslint.config.mjs — and has no presence in the application's runtime or business logic code. Its sole role is to instantiate FlatCompat, which acts as a bridge allowing legacy ESLint plugin and configuration formats to operate within ESLint's modern flat config system. This is a standard infrastructure dependency that enables the development team to maintain linting standards during the ecosystem's ongoing transition to the new ESLint configuration format, without requiring a full migration of existing ESLint rule configurations.

• The sole usage of @​eslint/eslintrc in the codebase is a single FlatCompat import. The public API surface used (FlatCompat constructor and .extends()) is unchanged in this patch release, so no code changes are required.
  

  fossa-action/eslint.config.mjs

  Line 11 in 015decb

  import { FlatCompat } from "@eslint/eslintrc";

• FlatCompat is instantiated with baseDirectory, recommendedConfig, and allConfig — all standard constructor options that are unaffected by the internal js-yaml dependency bump introduced in this patch.
  

  fossa-action/eslint.config.mjs

  Line 15 in 015decb

  const compat = new FlatCompat({

Changes

@​eslint/eslintrc was updated to address a security vulnerability in its js-yaml dependency, which has been upgraded to a patched release that also includes YAML parsing bug fixes.

• update js-yaml to 4.3.2 to address security vulnerability (#243) (bb0d97a) (v3.3.6-3.3.7, changelog)
• Bump js-yaml to 4.3.1 (#239) (f27e7c9) (v3.3.6-3.3.7, changelog)
• Updated js-yaml dependency from ^4.3.0 to ^4.3.2 to include bug fixes and improvements in YAML parsing (v3.3.7, package source)

View 1 more change

• Updated README.md with new sponsor information (TestMu AI Open Source Office) (v3.3.7, package source)

References (4)

[1]: The package is declared as a devDependency at ^3.3.7, confirming this upgrade is entirely scoped to developer tooling and does not affect production runtime behavior.

fossa-action/package.json

Line 21 in 015decb

"@eslint/eslintrc": "^3.3.7",

[2]: The sole usage of @​eslint/eslintrc in the codebase is a single FlatCompat import. The public API surface used (FlatCompat constructor and .extends()) is unchanged in this patch release, so no code changes are required.

fossa-action/eslint.config.mjs

Line 11 in 015decb

import { FlatCompat } from "@eslint/eslintrc";

[3]: FlatCompat is instantiated with baseDirectory, recommendedConfig, and allConfig — all standard constructor options that are unaffected by the internal js-yaml dependency bump introduced in this patch.

fossa-action/eslint.config.mjs

Line 15 in 015decb

const compat = new FlatCompat({

[4]: The only change in this release is updating the internal js-yaml dependency from ^4.3.0 to ^4.3.2 to address a security vulnerability in YAML parsing. This is an internal implementation detail with no API surface impact on consumers of @​eslint/eslintrc. (source link)

---

fossabot analyzed this PR using static analysis, dependency research and AI. View this analysis on the web

[fossabot]