Shelljs version 0.7.4 introduces key updates beneficial for developers leveraging Unix shell commands within Node.js environments. Compared to the preceding stable version, 0.7.3, it notably replaces jshint with eslint and related tools for code linting and style checking. Specifically, it incorporates eslint version ^2.0.0, eslint-plugin-import version ^1.11.1, and eslint-config-airbnb-base version ^3.0.0, signaling a shift towards a more modern and configurable linting approach. This move allows for better code quality enforcement and adherence to established style guides like Airbnb's, helping developers maintain consistent and clean codebases.
The core functionalities and dependencies remain largely unchanged between the two versions, with glob, rechoir, and interpret being consistent dependencies. This indicates stability in the fundamental shell operations provided by the library. The development-focused tools such as shelljs-release, shelljs-changelog, and travis-check-changes also persist, ensuring a continuous and well-managed development workflow.
For developers, these changes suggest that upgrading to version 0.7.4 primarily ensures leveraging a more up-to-date, robust, and widely adopted linting ecosystem with ESLint, likely improving code maintainability and reducing potential errors during development. The transition reflects a commitment to modern development practices.
All the vulnerabilities related to the version 0.7.4 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
