Yargs-parser is a popular and powerful option parsing library favored by the yargs command-line argument parser. Analyzing versions 9.0.0 and 8.1.0 reveals subtle but important differences for developers. Both versions share core dependencies like camelcase for converting strings to camel case and development dependencies for testing, code quality (like standard for code style), and code coverage.
The most notable change lies in the standard-version dependency within devDependencies. Version 9.0.0 utilizes standard-version at ^4.3.0, whereas version 8.1.0 employs a candidate version: ^4.3.0-candidate.0. This signifies that version 9.0.0 likely incorporates the fully released and stable version of standard-version, implying improved release management and potentially fewer bugs associated with this tool compared to the "candidate" release in 8.1.0. Standard-version automates version bumping and changelog generation, streamlining the release process, so adopting a stable version helps ensure consistency.
Another key difference is the release date. Version 9.0.0 was released on January 20, 2018, while version 8.1.0 was released on December 20, 2017. While seemingly minor, this one-month gap suggests that version 9.0.0 may contain bug fixes, performance enhancements, or feature additions that were implemented in the intervening period. Developers should review the changelog or release notes to understand the specific improvements included in version 9.0.0 before upgrading. Both versions are authored by Ben Coe, and the core functionality of yargs-parser, namely parsing command-line options, remains consistent between the two.
All the vulnerabilities related to the version 9.0.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
