Only the latest version is supported. Firefox might use a slightly older version, which is supported-ish.
We assume that a project which makes use of this plugin to apply a reasonable amount of scrutiny to all patches that are accepted. We understand that this is a fuzzy line and the level of expected judgement and sensitivity to security issues will vary between projects and reviewers.
JavaScript static analysis is always very limited. On top we are limiting ourselves to the APIs that are provided by eslint. Most notable, there's no constant folding, so we can't allow variables that have been defined statically in different code paths or different files.
Here's a a couple of examples which we do not consider a bug in the linter:
foo['inner'+'HTML'] = evil; // no way to resolve concatenation
eval(atob(...)) // use eslint no-eval rules please.
function(d) { return document }
d.write(evil); // no way to resolve "d" staticallyMomentarily, we do not offer a bug bounty for security issues with this linter rule. Note that projects who depend on this linter might.
If what you found is leading to a vulnerability in any of the project that make use of this library, please follow the rules for that respective project. I.e., for Firefox please follow the Mozilla Client Bug Bounty FAQ and use the linked bugzilla submission form (requires you to create an account).
Hey, did you read "What is considered a vulnerability", above?
If what you found constitues in a code pattern that eslint should complain about, but doesn't, please file a private bug Bugzilla using this form (requires creating an account).