Update dependency eslint to v6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
eslint (source)	dependencies	major	5.16.0 -> 6.0.1

---

Release Notes

eslint/eslint

v6.0.1

Compare Source

• b5bde06 Fix: --rulesdir option didn't work (fixes #​11888) (#​11890) (Toru Nagashima)
• 13f0418 Fix: improve error message on --print-config (fixes #​11874) (#​11885) (Toru Nagashima)
• 056c2aa Fix: improve diagnostics for shareable-config-missing errors (#​11880) (Teddy Katz)
• 566b7aa Docs: Update no-confusing-arrow with the new default option (#​11886) (Yuping Zuo)
• d07f3fa Fix: CLIEngine#getRules() contains plugin rules (fixes #​11871) (#​11872) (Toru Nagashima)
• 21f4a80 Docs: Fix inconsistent linking in migration guide (#​11881) (Teddy Katz)
• f3a0774 Docs: Fix typo in 6.0.0 migration guide (#​11870) (Kevin Partington)

v6.0.0

Compare Source

• 81aa06b Upgrade: [email protected] (#​11869) (Teddy Katz)
• 5f022bc Fix: no-else-return autofix produces name collisions (fixes #​11069) (#​11867) (Milos Djermanovic)
• ded9548 Fix: multiline-comment-style incorrect message (#​11864) (golopot)
• cad074d Docs: Add JSHint W047 compat to no-floating-decimal (#​11861) (Timo Tijhof)
• 41f6304 Upgrade: sinon (#​11855) (Toru Nagashima)
• 167ce87 Chore: remove unuseable profile command (#​11854) (Toru Nagashima)
• c844c6f Fix: max-len properly ignore trailing comments (fixes #​11838) (#​11841) (ZYSzys)
• 1b5661a Fix: no-var should not fix variables named 'let' (fixes #​11830) (#​11832) (Milos Djermanovic)
• 4d75956 Build: CI with Azure Pipelines (#​11845) (Toru Nagashima)
• 1db3462 Chore: rm superfluous argument & fix perf-multifiles-targets (#​11834) (薛定谔的猫)
• c57a4a4 Upgrade: @​babel/polyfill => core-js v3 (#​11833) (薛定谔的猫)
• 65faa04 Docs: Clarify prefer-destructuring array/object difference (fixes #​9970) (#​11851) (Oliver Sieweke)
• 81c3823 Fix: require-atomic-updates reports parameters (fixes #​11723) (#​11774) (Toru Nagashima)
• aef8ea1 Sponsors: Sync README with website (ESLint Jenkins)

---

Renovate configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR becomes conflicted, or if you modify the PR title to begin with "rebase!".

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot. View repository job log here.

[EnTeQuAk]

I started to work on this.

[renovate]

PR has been edited

👷 This PR has received other commits, so Renovate will stop updating it to avoid conflicts or other problems. If you wish to abandon your changes and have Renovate start over you may click the "rebase" checkbox in the PR body/description.

[mantou132]

Eslint 5 uses esllint-utils 1.4.0
esllint-utils 1.4.0 has cve bug
GHSA-3gx7-xhv7-5mx3

[webmaster128]

Any updates on this PR? It would be good to get eslint 5 out of the dependency tree

[webmaster128]

Could you use the caret notation ^6.0.1, such that we don't need to install multiple versions of eslint 6 in larger projects?

[EnTeQuAk]

I started working on this again and I'm hoping to land this for the Feb 27th milestone.

[Rob--W]

eslint 6.0.0 introduces a feature (rfc) that can potentially cause execution of arbitrary code when the linter is run on a third-party project.

Before bumping the version, please verify that this doesn't negatively affect the goals of addons-linter. If needed, set the resolvePluginsRelativeTo option (introduced here (rfc)) to explicitly fix the location of plugins.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing, however it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

[willdurand]

eslint 6.0.0 introduces a feature (rfc) that can potentially cause execution of arbitrary code when the linter is run on a third-party project.

Before bumping the version, please verify that this doesn't negatively affect the goals of addons-linter. If needed, set the resolvePluginsRelativeTo option (introduced here (rfc)) to explicitly fix the location of plugins.

@Rob--W do you think it is a problem given that the linter does not seem to load any eslintrc config?

We still need to load some plugins, and the default value for this new option is CWD so I am not sure what else we could do? Do you think the linter would load a ESLint plugin located in a file/folder of a webext?