Yargs is a popular command-line argument parser for Node.js, known for its modern, pirate-themed approach and its role as the successor to the optimist library. Comparing versions 11.1.1 and 11.1.0 reveals subtle but potentially important differences for developers. Both versions share the same core description, dependencies like y18n for internationalization, cliui for building command-line user interfaces, and yargs-parser for the underlying argument parsing. The development dependencies also remain consistent, indicating a shared tooling and testing environment.
The key difference lies in the os-locale dependency, which jumps from version 2.0.0 in 11.1.0 to version 3.1.0 in 11.1.1. This might seem minor, but os-locale determines the user's operating system locale, potentially impacting how Yargs handles localized messages and input. Developers relying on accurate locale detection should investigate the changes in os-locale between these versions. Additionally, the dist object shows a difference in unpackedSize, with 11.1.1 being slightly smaller. This could be due to minor code optimizations or dependency updates. Finally, the releaseDate is significantly different, with version 11.1.1 released much later than 11.1.0. For developers, upgrading offers the advantage of potentially improved locale handling and possibly a smaller package size, alongside any bug fixes and under-the-hood optimisations tied to the updated dependencies.
All the vulnerabilities related to the version 11.1.1 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
