Report suspected vulnerabilities privately through the GitHub security advisory form for alexandroit/stackline-esprima. Do not disclose an unfixed vulnerability in a public issue.

Include the affected version, source sample, options, runtime, observed impact, resource measurements, and a minimal reproduction. Maintainers will validate the report and coordinate disclosure with a fixed release.

The latest published 1.x release is supported on Node.js 8 and newer.

Version 1.0.0 has no production, optional, or peer dependencies. Release gates require a warning-free packed install, a valid npm tree, and zero production and full-lockfile audit findings.

CodeQL scans the parser, build, package scripts, maintained tests, and docs. Immutable historical JavaScript libraries under test/3rdparty are parser regression inputs and are not shipped or executed by consumers; they are excluded from CodeQL source analysis so vulnerabilities in those archived fixtures are not misreported as package runtime findings.

The parser does not execute parsed source. Parsing still consumes CPU and memory. Applications accepting untrusted input must enforce maximum input size, concurrency, memory, and request deadlines at their trust boundary.