Prettier version 0.20.0 represents a minor update to the widely-used JavaScript code formatter, introducing subtle but impactful changes for developers. Released on February 28, 2017, it builds upon the foundation of version 0.19.0, released just days prior on February 23, 2017. Key improvements reside within the dependency updates. Notably, the flow-parser dependency sees an upgrade from version 0.38.0 to 0.40.0. This enhancement likely addresses bug fixes or expands support for newer Flow syntax, ensuring smoother parsing and formatting of Flow-typed JavaScript code.
Changes in the development dependencies include the removal of rollup-plugin-real-babili, a Babel minifier, and the addition of rollup-plugin-node-builtins. These modifications hint at adjustments in the build process, potentially optimizing bundle size or improving compatibility with different environments. While the core functionality remains consistent, these dependency tweaks could result in more reliable and efficient formatting experiences. Developers upgrading from 0.19.0 to 0.20.0 can expect improved Flow support and potential build optimizations, leading to a more seamless integration of Prettier in their workflows. The core formatting behaviors and the opinionated nature of Prettier are likely unchanged, ensuring consistent code style across projects. Consider testing your project with the new version to verify compatibility.
All the vulnerabilities related to the version 0.20.0 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
