Acorn version 6.2.0, released on July 4, 2019, introduces improvements over its predecessor, version 6.1.1, which was released on February 27, 2019. Both versions serve as robust ECMAScript parsers with an MIT license, making them freely usable in a wide range of projects. The core functionality remains consistent, focusing on providing a fast and reliable parsing engine for JavaScript code.
A notable difference between the two versions lies in the unpacked size, with version 6.2.0 being slightly larger at 1101068 bytes compared to version 6.1.1's 1093303 bytes. This increase likely reflects minor enhancements, bug fixes, or support for newly introduced ECMAScript features incorporated into the newer version. Developers should always use the latest version to have the latest features and bug fixes. Also, by keeping the library updated, there will be no issues during builds or integration with other libraries. Acorn is a very tiny library so the impact on the overall size is minimal. While both versions maintain the same file count of 11, this size difference hints at internal code optimization or the addition of small support files.
Potential users of Acorn will benefit from its speed, standards compliance, and ease of integration into build tools, linters and code analysis tools. Given that each of these versions has an MIT license, developers have no restriction using them in open source or commercial projects. The choice between the two specifically may boil down to specific bug fixes or ECMAScript feature support present in version 6.2.0 that might be necessary for a project.
All the vulnerabilities related to the version 6.2.0 of the package
Regular Expression Denial of Service in Acorn
Affected versions of acorn are vulnerable to Regular Expression Denial of Service. A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser. If an application processes untrusted input and passes it directly to acorn, attackers may leverage the vulnerability leading to Denial of Service.
