Prettier version 1.1.0 represents a minor but noteworthy update over its predecessor, version 1.0.2, in the popular JavaScript code formatter. For developers, the core functionality remains consistent: Prettier automatically formats code to adhere to a consistent style, improving readability and collaboration. Both versions share identical dependencies, including essential packages like glob for file pattern matching, chalk for terminal styling, babylon for JavaScript parsing, and ast-types for Abstract Syntax Tree manipulation, ensuring the core formatting engine is stable. Similarly, development dependencies for testing and building, such as jest, rollup, and typescript, are unchanged, indicating a stable development pipeline. While the functional changes might be subtle, staying current is still important. The most visible difference is the release date; version 1.1.0 was published on April 14, 2017, shortly after version 1.0.2's release on April 13, 2017. While there are no obvious dependency difference listed. It is normal for minor patch versions like this to focus on bug fixes and incremental improvements. This iterative process means that developers can get security and stability improvements, and access support for newer language features if updated.
All the vulnerabilities related to the version 1.1.0 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
