Yargs, a popular and actively maintained command-line argument parser for Node.js, released version 6.5.0, building upon the foundation of version 6.4.0. Both versions maintain the core promise of being a modern, pirate-themed successor to optimist, designed for effortless command-line interface (CLI) creation. Developers familiar with earlier versions will find a seamless transition.
The key difference lies in an updated dependency: yargs-parser. Version 6.5.0 bumps this dependency from ^4.1.0 to ^4.2.0. This update likely contains bug fixes, performance improvements, and potentially new parsing features within the underlying argument parsing engine. While the change may not dramatically alter the core Yargs API, developers should be aware of potentially subtle variances in argument parsing behavior and consult the yargs-parser changelog for detailed information.
Both versions of Yargs offer dependendecies such as y18n for internationalization, cliui for building user-friendly CLIs, and camelcase and decamelize for string manipulation. Important to note that version 6.5.0 comes with the updated version of nyc from 8.3.2 to 10.0.0 and standard from 8.2.0 to 8.6.0. Also, the releaseDate is newer for the version 6.5.0 and that means that this is the recommended version to use. As always, thorough testing is recommended when upgrading between minor versions to ensure compatibility with existing CLI applications.
All the vulnerabilities related to the version 6.5.0 of the package
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --foo.__proto__.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.
Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
