@commitlint/cli version 4.0.0 introduces key updates for developers seeking to enforce commit message conventions. The core functionality, aimed at linting commit messages for consistency and clarity, remains a central feature. Examining the changes from version 3.2.0 reveals that the primary shift lies in the updated dependency on @commitlint/core, which jumps from version 3.2.0 to 4.0.0. This suggests potential refinements in the core linting logic, rule sets, or extensibility options. Developers should investigate @commitlint/core's changelog for a complete understanding of these improvements.
Both versions share a common set of dependencies, including meow for CLI argument parsing, chalk for stylized console output, lodash for utility functions, get-stdin for reading from standard input, and babel-polyfill for broader JavaScript compatibility. The development dependencies, encompassing testing frameworks like ava and linting tools like xo, remain consistent, implying a stable development workflow. The presence of tools like execa, mkdirp, rimraf, and sander points to a build process that involves file system operations and external command execution, while resolve-bin aids in locating executable files within dependencies. Version 4.0.0 release date is also almost a month later which may mean it includes more bug fixes and refinements for a better experience.
All the vulnerabilities related to the version 4.0.0 of the package
Uncontrolled Resource Consumption in trim-newlines
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
dot-prop Prototype Pollution vulnerability
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
