Yargs version 4.7.0 represents an incremental update to the popular command-line argument parsing library, building on version 4.6.0. Both versions maintain the core functionality, providing a robust and user-friendly way to build interactive command-line tools. Developers familiar with yargs will appreciate the continued focus on ease of use, with features like automatic help message generation, argument validation, and sub-command support.
A key difference lies in the updated development dependencies. Version 4.7.0 sees a shift to nyc version 6.4.2 and standard version 7.0.0, updated from nyc version 6.1.1 and standard version 6.0.5. Additionally, standard-version moves to version 2.2.1 from 2.1.2. These upgrades primarily impact the development workflow, likely including improvements in code quality checks, test coverage reporting and release management process.
For developers, the core yargs experience remains consistent between these versions. The dependency list remains the same. Both versions leverage the same underlying packages for core functionalities such as internationalization (y18n), UI construction (cliui), configuration management (pkg-conf), and argument parsing (yargs-parser). The move from version 4.6.0 to 4.7.0 is therefore a smooth transition, ensuring continued compatibility while incorporating development tool chain updates contributing to a more robust and maintainable library. If you're using it in a project, this version provides updated testing and linting tools facilitating a more streamlined process.
All the vulnerabilities related to the version 4.7.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
