Prettier version 0.17.1 represents a minor iteration over its predecessor, 0.17.0, both aiming to provide an opinionated JavaScript formatting experience. Examining their package metadata reveals a nearly identical structure in terms of core functionality. Both versions share the same set of dependencies, including 'glob', invaluable for file system navigation, 'chalk' for terminal styling, 'babylon' – a precursor to Babel parser – for JavaScript parsing, 'esutils' for ECMAScript language utilities, 'minimist' for argument parsing, 'ast-types' handling Abstract Syntax Trees, 'get-stdin' for effortlessly reading from standard input, 'flow-parser' ensuring Flow type annotations are correctly interpreted, 'jest-validate' fortifying configuration integrity, and 'babel-code-frame' generating informative code snippets enhancing error diagnostics. The 'devDependencies' showcasing tools utilized during the development lifecycle are also identical, featuring 'diff' for highlighting code modifications, 'jest' for robust testing, 'rollup' for efficient module bundling, and diverse Rollup plugins optimizing the bundling process targeting Node.js environments. The key distinction lies in the "releaseDate," implying internal bug fixes, performance enhancements, or minor adjustments that warranted a quick patch release after version 0.17.0. For developers seeking optimal stability, upgrading to 0.17.1 is advisable, benefitting from any refinements incorporated since the initial 0.17.0 release. Since the dependencies are the same both versions expose the same api and functionality.
All the vulnerabilities related to the version 0.17.1 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
