Yargs-parser, a popular option parsing library utilized by yargs, underwent a minor version update from 13.0.0 to 13.1.0, introducing subtle yet potentially impactful changes for developers. Both versions share core dependencies: camelcase (version 5.0.0 or higher) for converting strings to camel case and decamelize (version 1.2.0) for the reverse operation. The key differences reside in the development dependencies.
Version 13.1.0 upgrades nyc, the code coverage tool, to version 14.1.0, providing enhanced reporting and potentially more accurate coverage metrics. A seemingly minor update, it reflects a commitment to code quality. Another notable update concerns standard-version, a tool for automating versioning and CHANGELOG generation, which moved from version 4.4.0 to 6.0.0. This significant jump implies breaking changes or substantial feature additions in the versioning process, warranting developer awareness during upgrades.
Besides the version bumps, considering 13.1.0 unpacked size increased a little bit means new code has been added to the library. The release date shows around 3 months of work and it is an indicator of the stability.
For developers relying on specific behaviors of nyc or standard-version, reviewing the respective changelogs is crucial. The library is licensed under ISC license. The Git repository on Github makes it ready to use in CI/CD environment with the option to contribute by pull requests.
All the vulnerabilities related to the version 13.1.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
