Yargs version 5.0.0 represents an incremental update to the popular command-line argument parsing library, succeeding version 4.8.1. Both versions share the same core description: yargs remains a modern, pirate-themed successor to optimist, designed to simplify building interactive command-line tools in Node.js.
A significant difference lies in the updated dependencies. Yargs 5.0.0 upgrades yargs-parser from version 2.4.1 to 3.2.0 and lodash.assign from version 4.0.3 to 4.2.0, potentially introducing new features, performance improvements, or bug fixes within these core utilities relevant to argument handling and object manipulation. Developers should consult the changelogs of these specific packages to understand the impact of these updated dependencies within their projects. The bump of the yargs-parser library is really relevant because it's the library used to parse the arguments.
The newer version also shows updates in the devDependencies, particularly nyc which has been bumped from 7.0.0 to 8.1.0 and mocha from version 2.5.2 to 3.0.1 pointing to refinements in development and testing infrastructure rather than direct changes to end-user code. Importantly, the development environment received attention. These updates suggest improvements in code coverage reporting as well since nyc is a code coverage tool and also enhancements to the testing framework.
Both versions maintain the same MIT license and repository details, ensuring continuity in licensing terms and source code access for developers. Each specific version can be obtained through its designated tarball URL on the npm registry.
All the vulnerabilities related to the version 5.0.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
