Yargs, a popular Node.js library for building interactive command-line tools, released version 6.1.1 shortly after version 6.0.0, offering stability and minor improvements. Both versions provide a robust framework for parsing arguments and generating help messages, making it easier for developers to create user-friendly CLIs.
The core functionalities remain consistent between the two versions. Developers can leverage Yargs' declarative API to define options, arguments, and commands, while automatically generating documentation. Dependencies related to internationalization (y18n), UI construction (cliui), and path resolution have similar versions suggesting no major changes in these features.
The most notable difference lies in the updated camelcase dependency in version 6.1.1 suggesting bug fixing or better handling of edge cases for conversion between strings and camel case notation. Also, version 6.1.1 has standard-version bumped to v3.0.0, which could be used to automate versioning and release tasks.
For developers, the upgrade from 6.0.0 to 6.1.1 is likely straightforward, mostly useful for those that were facing minor bugs related to camelcase, or use features of standard-version library. Both versions come equipped with everything needed to parse command-line input, handle arguments with validation and default values, and build nested command structures for complex applications. Users can expect consistent results using either version, depending on their specific projects' needs.
All the vulnerabilities related to the version 6.1.1 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
