Yargs-parser is a widely adopted option parsing library, central to the popular yargs command-line argument parser. Focusing on versions 7.0.0 and 8.0.0 of yargs-parser, a few subtle differences become apparent for developers considering an upgrade. Both versions share the same core dependency: camelcase^4.1.0, indicating consistent handling of argument naming conventions. Similarly, their developer dependencies for testing and linting (nyc, chai, mocha, standard, coveralls, standard-version) remain largely the same, suggesting continued adherence to code quality and testing practices. The license remains ISC, and the repository URL confirms the project's location within the yargs GitHub organization. The author is consistently listed as Ben Coe.
The crucial distinction lies in the nyc version used for code coverage, upgraded from 10.0.0 in version 7.0.0 to 11.2.1 in version 8.0.0. This suggests potential improvements or bug fixes in the testing infrastructure, possibly leading to more reliable coverage reports. Moreover, the release dates highlight a significant gap, with version 7.0.0 released in May 2017 and 8.0.0 in October 2017. For developers, this timeframe implies accumulated bug fixes, performance enhancements, and potentially new features incorporated within the 8.0.0 release. When deciding whether to upgrade, developers should consider the maturity of version 8.0.0 and the potential benefits from an updated testing infrastructure.
All the vulnerabilities related to the version 8.0.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
