Gulp version 0.0.8 represents a minor iteration over its predecessor, version 0.0.7, both targeting developers seeking a "simple stream-y build helper." While the core functionality remains consistent, discernible differences lie primarily in dependency management and release timing. Both versions share core dependencies like mkdirp for directory creation, optimist for command-line argument parsing, glob-stream for file matching, and event-stream for stream manipulation, indicating a stable base feature set. Development dependencies for testing, such as mocha, rimraf, and should, also remain unchanged, suggesting continued focus on code quality through consistent testing practices.
The most noteworthy alteration is the introduction of gulp-util as a new dependency in version 0.0.8. This addition hints at enhanced utility functions within the build process, potentially offering improved logging, error handling, or other developer conveniences. Developers upgrading from 0.0.7 should investigate the gulp-util package to leverage its capabilities. Furthermore, the release dates indicate a short timeframe between the two versions, with 0.0.8 released just hours after 0.0.7 . This quick succession suggests a bug fix or a minor feature enhancement prompted the update. For developers considering Gulp for automating build tasks, these versions provide a foundational set of tools for streamlining workflows though newer versions are advised for better functionality .
All the vulnerabilities related to the version 0.0.8 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
