The npm package html-to-text version 3.0.0 offers an updated HTML to plain text conversion solution compared to its predecessor, version 2.1.3. Both versions maintain the core functionality of transforming HTML content into readable text, but key differences lie in their internal dependencies and developer tooling. A significant change is the replacement of the htmlparser dependency in version 2.1.3 with htmlparser2 in version 3.0.0. This swap likely reflects an update to a more actively maintained or feature-rich HTML parsing library, potentially offering improved parsing accuracy and handling of modern HTML structures. Another difference resides in the mocha testing framework, upgraded from version 2.4.5 to 3.0.0, suggesting enhancements to the testing suite and potentially a more reliable and robust codebase. Both versions share common dependencies like he for HTML entity encoding/decoding, optimist for command-line argument parsing, underscore, and underscore.string for utility functions. For developers considering an upgrade, the shift to htmlparser2 is a primary factor, potentially impacting how complex or malformed HTML is processed. The updated mocha version implies a more thoroughly tested library, contributing to overall stability. The core functionality remains consistent, providing a valuable tool for extracting text from HTML documents, a common need in scenarios like email processing, content indexing, and data analysis. Both versions are MIT licensed.
All the vulnerabilities related to the version 3.0.0 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
