Acorn versions 6.0.3 and 6.0.4 represent incremental updates to this popular ECMAScript parser library. Both are licensed under the MIT license and maintained within the acornjs GitHub repository. Developers leveraging Acorn for JavaScript parsing will find that both versions offer a robust and lightweight solution.
A notable change between the two versions lies in the unpacked size of the distributed tarball. Version 6.0.4 exhibits a slightly larger unpacked size of 1,084,020 bytes compared to version 6.0.3's 1,082,795 bytes. Although the file count remains consistent at 11, the minor size increase hints at possible bug fixes, performance improvements, or minor feature enhancements incorporated into the newer release. Developers should consider this when evaluating dependencies, especially in size-sensitive environments.
The release dates also highlight the proximity of the two versions, with 6.0.3 released on November 4th, 2018, and 6.0.4 following closely on November 5th, 2018. Such a quick follow-up suggests that version 6.0.4 may address critical bugs or issues identified in 6.0.3 shortly after its release. For developers seeking the most stable and up-to-date parsing experience, opting for version 6.0.4 is advisable. It's recommended to consult the Acorn's changelog or commit history on GitHub for detailed information about the specific changes introduced in version 6.0.4. This ensures developers can fully understand the impact of the update on their projects and make informed decisions accordingly.
All the vulnerabilities related to the version 6.0.4 of the package
Regular Expression Denial of Service in Acorn
Affected versions of acorn are vulnerable to Regular Expression Denial of Service. A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser. If an application processes untrusted input and passes it directly to acorn, attackers may leverage the vulnerability leading to Denial of Service.
