Eslint is a popular JavaScript linting tool designed to identify and report on problematic patterns found in ECMAScript/JavaScript code. Comparing versions 0.1.4 and 0.1.3 highlights key changes for developers. Both versions share core dependencies like escope, esprima, optimist and estraverse. The fundamental functionality, description, license, repository, and author information remain consistent, signifying a focus on core stability. The primary differences lie in the development dependencies, indicating shifts in the development workflow.
Version 0.1.4 replaces several Grunt-related development dependencies present in version 0.1.3 (grunt, grunt-cli, grunt-istanbul, grunt-mocha-test, grunt-contrib-copy, grunt-contrib-clean, grunt-contrib-jshint, grunt-istanbul-coverage) with jshint, shelljs, istanbul and jsonlint. This suggests a potential move away from a purely Grunt-based build process to a more streamlined approach possibly leveraging shell scripts or other task runners alongside JSHint for linting. The introduction of jsonlint suggests a greater focus on validating JSON files within the project itself. For developers considering upgrading, this signifies a change in the tools used for contributing to ESLint itself, hinting at a potentially simpler developer experience. Importantly, this update doesn't obviously change the core linting capabilities or configuration impacting end-users directly, but reflects improvements in the project's build and testing infrastructure. The update indicates a focus on project health and developer productivity.
All the vulnerabilities related to the version 0.1.4 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
