Depcheck version 0.9.0 represents an incremental update over the previous stable release, version 0.8.4, primarily focusing on internal improvements and dependency management. The core functionality of checking for unused dependencies in Node.js projects remains consistent. A notable change is the removal of the direct dependency on the "deprecate" package. While seemingly minor, this adjustment reflects an effort to streamline the project's dependencies and potentially address compatibility or security concerns associated with the removed package. Both versions share a common set of core dependencies critical to their operation, including "yargs" for command-line argument parsing, "lodash" for utility functions, "js-yaml" for YAML parsing, "resolve" for module resolution, "walkdir" for directory traversal, and Babel-related packages for JavaScript parsing and transformation.
Developers upgrading to version 0.9.0 might observe a slight reduction in the overall project size, as indicated by the differing "unpackedSize" values in the distribution metadata, hinting at a leaner codebase after the "deprecate" package removal. The development dependencies, crucial for testing and building the project, remain nearly identical across both versions, ensuring a consistent development environment for contributors. Notably, the release dates are very close to each other, meaning that if you have the 0.8.4 probably it's a good idea to upgrade to the newest stable version. For users already familiar with Depcheck, the migration to version 0.9.0 should be seamless, as the fundamental usage and command-line interface remain unchanged. The update mainly provides underlying improvements, potentially enhancing stability and maintainability.
All the vulnerabilities related to the version 0.9.0 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
