Prettier version 0.0.9 represents a minor iteration over the preceding 0.0.8, offering refinements and updates that contribute to a more robust and reliable code formatting experience. Key distinctions lie within the dependencies, where flow-parser sees an upgrade from version 0.37.0 to 0.38.0. This update likely incorporates enhanced support for newer Flow syntax and features, crucial for developers working with Flow type annotations. While other dependencies like jsesc, babylon, esutils, private, minimist, ast-types, and get-stdin remain largely consistent in their specified versions, the subtle shifts, especially in a rapidly evolving ecosystem like JavaScript, can translate into improved parsing accuracy and compatibility.
For developers using Prettier, this incremental update signifies a commitment to staying current with the latest language specifications and tools. Although the core functionalities of code formatting remain consistent, the under-the-hood optimizations and dependency upgrades contribute to a smoother and more predictable experience. Notably, both versions leverage a robust set of development dependencies, including jest for testing and rollup with its plugins for bundling, indicating a focus on code quality and efficient distribution. The MIT license ensures broad usability in various project contexts. Consider upgrading to 0.0.9 if you're working with the newest Flow features to benefit from the updated parser, ultimately promoting cleaner and more maintainable codebases.
All the vulnerabilities related to the version 0.0.9 of the package
Prototype Pollution in minimist
Affected versions of minimist
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted
adds a y
property with value Polluted
to all objects. The argument --__proto__=Polluted
raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist
.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js
, function setKey()
(lines 69-95).