Shelljs 0.7.7 represents a subtle but important update over its predecessor, version 0.7.6, in the popular shelljs library. Both versions are designed to bring familiar Unix shell commands to Node.js environments, allowing developers to execute commands like ls, cp, rm, and grep directly from their JavaScript code. This capability streamlines many development workflows, especially those involving build processes, file manipulation, and system administration tasks.
The core dependencies remain consistent: glob for file pattern matching, rechoir for loading configuration files, and interpret to handle different extensions, ensuring compatibility. Similarly, the development dependencies, used for testing and linting, are unchanged. This includes tools like ava for testing, nyc for code coverage, eslint for code style enforcement (along with Airbnb's base config and import plugin), and tools for release management and changelog generation for internal project maintainability.
The key and most important difference between 0.7.6 and 0.7.7 lies in the release date and potentially, some minor bug fixes or internal improvements. Version 0.7.7 was released on March 9, 2017, while 0.7.6 was released on January 8, 2017. Developers upgrading should check the changelog for any specific fixes or enhancements included in the 0.7.7 version, although the absence of major version number changes suggests the update primarily focused on stability and minor issues.
For developers new to shelljs, both versions 0.7.6 and 0.7.7 provide a straightforward method to incorporate shell scripting functionality within Node.js. Be sure to check the official documentation to understand the library's features and usage, and to stay up-to-date with any future versions and important changes.
All the vulnerabilities related to the version 0.7.7 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
