Yargs-parser, a robust option parsing library favored by the popular yargs package, saw a minor version update from 10.0.0 to 10.1.0. While both share the same core functionality and dependencies like camelcase for argument name conversion, several subtle distinctions warrant attention for developers. Crucially, the unpacked size of the library increased slightly from 47232 bytes to 48440 bytes, suggesting internal improvements or additions, though the file count remained consistent at six.
Both versions maintain identical developer dependencies including tools for testing (chai, mocha), code style enforcement (standard), test coverage (nyc, coveralls) and release management (standard-version). This indicates a consistent development workflow and commitment to code quality. The license remains ISC, and the repository URL, author, and description are unchanged.
The most noticeable difference is the release date. Version 10.0.0 was released on April 4, 2018, while version 10.1.0 followed on June 29, 2018. This approximately three-month gap implies bug fixes, performance enhancements, or minor feature additions in version 10.1.0. While the specific changes aren't detailed in the provided metadata, developers should strongly consider upgrading to the newer version to benefit from any stability improvements or new capabilities it offers within its option parsing framework. Always consult the project's changelog or repository commits for a comprehensive understanding of the changes.
All the vulnerabilities related to the version 10.1.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz'
adds a bar
property with value baz
to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser
.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.