Acorn version 6.0.3 represents a minor but significant update to the popular ECMAScript parser, building upon the foundation of its predecessor, version 6.0.2. Both versions, licensed under the MIT license, maintain their core function of parsing JavaScript code and share the same repository on GitHub under the acornjs organization. The development team seems to prioritize iterative improvements as evidenced by the slight changes between versions.
A key difference lies in the "unpackedSize", where version 6.0.3 has a slightly larger footprint at 1082795 bytes compared to version 6.0.2's 1076793 bytes. This suggests that the newer version incorporates additional functionalities, bug fixes, or optimizations that contribute to the increased size of around 6KB. The update was released on November 4, 2018 which follows the release of the prior version on September 26, 2018.
For developers, this incremental update means potentially benefiting from subtle enhancements without introducing major breaking changes, as confirmed by the identical number of files in the distributed package. Projects already leveraging Acorn 6.0.2 can likely upgrade to 6.0.3 with minimal effort and benefit from recent bug fixes. While specific details on the changes aren't provided here, developers should check the Acorn changelog or release notes for a more comprehensive understanding of the improvements introduced in version 6.0.3. These updates frequently address edge cases and improve parser stability, ensuring a more robust experience for those utilizing Acorn to analyze and manipulate JavaScript code.
All the vulnerabilities related to the version 6.0.3 of the package
Regular Expression Denial of Service in Acorn
Affected versions of acorn are vulnerable to Regular Expression Denial of Service. A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser. If an application processes untrusted input and passes it directly to acorn, attackers may leverage the vulnerability leading to Denial of Service.
