Acorn version 5.7.0 is a minor release of the popular ECMAScript parser, building upon the solid foundation of version 5.6.2. Both versions share the same core functionality, offering developers a fast and reliable way to parse JavaScript code. They also maintain the same suite of development dependencies, including ESLint for code linting, Rollup for bundling, and test262 for ensuring compliance with ECMAScript standards. Other shared devDependencies are eslint-plugin-node, rollup-plugin-buble, eslint-plugin-import, eslint-plugin-promise, test262-parser-runner, eslint-config-standard, and eslint-plugin-standard.
The key difference lies in the updated Unicode support. Version 5.7.0 upgrades to unicode-11.0.0 "^0.7.7", while 5.6.2 uses unicode-10.0.0 "^0.7.5". This means 5.7.0 supports the latest Unicode characters and features available at the time of its release, providing more accurate parsing and handling of modern JavaScript code that utilizes newer Unicode symbols and features.
For developers, this update ensures better compatibility with cutting-edge JavaScript syntax. If your project involves handling a wide range of Unicode characters, particularly those introduced in Unicode 11.0, upgrading to Acorn 5.7.0 is highly recommended. Otherwise, the performance and core parsing capabilities remain largely consistent between the two versions. Both versions are distributed under the MIT license and hosted on GitHub, making them freely accessible and easy to integrate into various projects. The unpacked size is slightly larger in the newer version, suggesting the addition of new tests or data related to the unicode update.
All the vulnerabilities related to the version 5.7.0 of the package
Regular Expression Denial of Service in Acorn
Affected versions of acorn are vulnerable to Regular Expression Denial of Service. A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser. If an application processes untrusted input and passes it directly to acorn, attackers may leverage the vulnerability leading to Denial of Service.
