File tree 3 files changed +8
-4
lines changed
3 files changed +8
-4
lines changed Original file line number Diff line number Diff line change 2
2
3
3
## not yet released
4
4
5
+ (nothing yet)
6
+
7
+ ## 11.0.0
8
+
5
9
- ** Backward incompatible** and ** security-related** change to parsing the
6
10
` -d DELIM ` option. ([ #148 ] ( https://github.com/trentm/json/issues/148 ) )
7
11
23
27
Before this change, that parsing used ` eval() ` , which allowed for unintended
24
28
code execution if an untrusted argument to ` -d ` was provided. The fix for
25
29
this vulnerability changes to use ` JSON.parse() ` to support escapes. However
26
- that results in a backward incompatible change, because the set
27
- [ JSON escapes] ( https://tools.ietf.org/html/rfc7159#section-7 ) is a subset of
30
+ that results in a backward incompatible change, because the set of
31
+ [ JSON escapes] ( https://tools.ietf.org/html/rfc7159#section-7 ) is a * subset* of
28
32
[ JavaScript escapes] ( https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String#escape_notation ) .
29
33
30
34
The only escape I expect that would affect any current user would be the
Original file line number Diff line number Diff line change 8
8
* See <https://github.com/trentm/json> and <https://trentm.com/json/>
9
9
*/
10
10
11
- var VERSION = '10 .0.0' ;
11
+ var VERSION = '11 .0.0' ;
12
12
13
13
var p = console . warn ;
14
14
var util = require ( 'util' ) ;
Original file line number Diff line number Diff line change 1
1
{
2
2
"name" : " json" ,
3
3
"description" : " a 'json' command for massaging and processing JSON on the command line" ,
4
- "version" : " 10 .0.0" ,
4
+ "version" : " 11 .0.0" ,
5
5
"repository" : {
6
6
"type" : " git" ,
7
7
"url" : " git://github.com/trentm/json.git"
You can’t perform that action at this time.
0 commit comments