Yargs-parser version 18.1.0 introduces subtle but potentially important distinctions from its predecessor, version 18.0.0. Both versions, retaining the description as "the mighty option parser used by yargs", share core dependencies like "camelcase" and "decamelize", crucial for argument parsing functionalities often used in command-line interfaces. Furthermore, the developer tooling, encompassing modules like "c8," "chai," "mocha," and "standard," remains largely consistent across both versions, indicating a similar approach to testing and code quality.
However, diving deeper reveals discernible differences. Version 18.0.0 includes "coveralls" as a dev dependency, a tool commonly used for tracking code coverage metrics. This dependency is absent in version 18.1.0, suggesting a possible shift in the project's coverage reporting strategy or an alternative tool being employed.
The "dist" object also presents differences; while both versions maintain a "fileCount" of 6, the "unpackedSize" increases from 68857 bytes in version 18.0.0 to 69197 bytes in version 18.1.0. This increase, although subtle, suggests that version 18.1.0 incorporates minor code additions or modifications. Finally, the "releaseDate" for version 18.1.0 is later, at "2020-03-07T19:43:04.413Z", whereas version 18.0.0 was released on "2020-03-02T06:01:50.935Z" making the newer version the latest stable release overall. These refinements likely address bug fixes, performance enhancements, or compatibility adjustments valuable for developers relying on robust option parsing capabilities within their applications and yargs ecosystem.
All the vulnerabilities related to the version 18.1.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
