Eslint 8.21.0 introduced a few new dependencies, can we review these?

[romainmenke]

ESLint version

8.21.0

What problem do you want to solve?

Each dependencies is a potential attack vector and slows down npm install, ....

see :

• https://npm.anvaka.com/#/view/2d/eslint/8.20.0
• https://npm.anvaka.com/#/view/2d/eslint/8.21.0

Were these dependencies sufficiently reviewed?

What do you think is the correct solution?

Confirm that these dependencies are the right choice for the project or remove them.

Participation

• I am willing to submit a pull request for this change.

Additional comments

No response

[nzakas]

Is there a particular package you are concerned about?

[romainmenke]

As long as each package is really needed and the maintainer is trusted by you there is no concern. I couldn't find any discussion in a relevant pull request about the added dependencies : #16149

Just caught my attention to see the number of installed packages go up by a non-trivial amount.

[nzakas]

Yeah, that's because we implemented the new config system, which required a bunch of new dependencies. If you have any specific concerns, please feel free to open another issue.