Yargs-parser, a crucial utility for command-line argument parsing utilized by the popular yargs package, saw a notable update from version 16.1.0 to 17.0.0. Both versions maintain the same core functionality and dependencies, relying on camelcase and decamelize for string conversions. However, the 17.0.0 release incorporates significant changes in its development dependencies, reflecting a shift in testing and code style practices.
Specifically, c8, a code coverage tool, was upgraded from version 6.0.0 to 7.0.1. Mocha, a Javascript testing framework, was upgraded from version 5.2.0 to version 7.0.0 reflecting a move to newer testing framework versions. Most importantly, standard, a Javascript style guide and linter, moved away from version 12.0.1 to version 14.3.1 which marks a commitment to more recent Javascript development standards. Standard-version was completely removed from version 17.0.0, suggesting an alternate version management process.
Beyond these development-focused changes, version 17.0.0 reflects a slight increase in the unpacked size of the package (66789 bytes versus 63609 bytes) suggesting minor additions and improvements to the core parser implementation. If you're upgrading from 16.1.0, be mindful of the potential linter and testing implications from the new development dependencies that are relevant to new releases. The package's release date moved from November 2019 to February 2020, indicating roughly a 3 month gap between the release cycles.
All the vulnerabilities related to the version 17.0.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
