npm-package-json-lint version 3.4.0 brings several updates compared to the previous stable version 3.3.1, offering developers enhanced capabilities for linting their package.json files. The core functionality, a configurable linter, remains intact, ensuring consistent formatting and adherence to best practices across projects.
Dependency upgrades are a key highlight. ajv is bumped from version 6.5.2 to 6.5.4, and glob goes from 7.1.2 to 7.1.3, potentially incorporating bug fixes and performance improvements. A subtle but important update is the semver dependency, moving from 5.5.0 to 5.5.1, indicating a patch or minor feature addition related to semantic versioning checks.
On the development dependencies front, eslint sees an upgrade from version 5.2.0 to 5.6.1 and eslint-config-tc from 4.1.0 to 4.2.0, suggesting enhancements to the linting rules used for the project's own codebase and potentially improvements in code style enforcement. One interesting aspect is that chai has been updated from 4.1.2 to 4.2.0 and an additional file has been added into the package, from 110 files to 111 files. These improvements enhance the developer experience by ensuring up-to-date tooling and coding standards are applied to enhance the consistency and quality of package.json files.
All the vulnerabilities related to the version 3.4.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
Uncontrolled Resource Consumption in trim-newlines
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Inefficient Regular Expression Complexity in validator.js
validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity
