Yargs-parser version 17.1.0 represents a minor update to the popular command-line argument parsing library, building upon the foundation laid by its predecessor, version 17.0.1. Both versions share core functionality, including dependencies on camelcase and decamelize for string manipulation, indicating a continued focus on developer convenience when handling input. The development dependencies remain consistent, with tools like c8, chai, mocha, standard, and coveralls ensuring code quality through testing, linting, and coverage reporting.
A key difference lies in the dist object. Version 17.1.0 exhibits a slightly larger unpackedSize (67949 bytes) compared to version 17.0.1 (67157 bytes), suggesting the introduction of new features, bug fixes, or performance improvements that contribute to the increased size. While the fileCount remains the same, developers should investigate the changelog or release notes for specific details about the updates.
The release dates also highlight the proximity of these versions, with 17.0.1 being released on February 29, 2020, and 17.1.0 following shortly after on March 1, 2020. This rapid release cycle likely indicates a swift response to reported issues or the quick implementation of small enhancements. Developers looking for the most up-to-date and potentially stable experience should opt for version 17.1.0, assuming no breaking changes are introduced. Always check release notes.
All the vulnerabilities related to the version 17.1.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
