CHANGELOG.md

@@ -3,6 +3,13 @@
 [c-unreleased]: https://github.com/json5/json5/tree/master
 [d-unreleased]: https://github.com/json5/json5/compare/v2.2.0...HEAD
 
+### v2.2.1 [[code][c2.2.1], [diff][d2.2.1]]
+
+[c2.2.1]: https://github.com/json5/json5/tree/v2.2.1
+[d2.2.1]: https://github.com/json5/json5/compare/v2.2.0...v2.2.1
+
+- Fix: Removed dependence on minimist to patch CVE-2021-44906. ([#266])
+
 ### v2.2.0 [[code][c2.2.0], [diff][d2.2.0]]
 
 [c2.2.0]: https://github.com/json5/json5/tree/v2.2.0
@@ -360,3 +367,4 @@ parser for the regular JSON format.
 [#229]: https://github.com/json5/json5/issues/229
 [#236]: https://github.com/json5/json5/issues/236
 [#244]: https://github.com/json5/json5/issues/244
+[#266]: https://github.com/json5/json5/issues/266

lib/cli.js

@@ -2,37 +2,17 @@
 
 const fs = require('fs')
 const path = require('path')
-const minimist = require('minimist')
 const pkg = require('../package.json')
 const JSON5 = require('./')
 
-const argv = minimist(process.argv.slice(2), {
-    alias: {
-        'convert': 'c',
-        'space': 's',
-        'validate': 'v',
-        'out-file': 'o',
-        'version': 'V',
-        'help': 'h',
-    },
-    boolean: [
-        'convert',
-        'validate',
-        'version',
-        'help',
-    ],
-    string: [
-        'space',
-        'out-file',
-    ],
-})
+const argv = parseArgs()
 
 if (argv.version) {
     version()
 } else if (argv.help) {
     usage()
 } else {
-    const inFilename = argv._[0]
+    const inFilename = argv.defaults[0]
 
     let readStream
     if (inFilename) {
@@ -65,7 +45,7 @@ if (argv.version) {
                 // --convert is for backward compatibility with v0.5.1. If
                 // specified with <file> and not --out-file, then a file with
                 // the same name but with a .json extension will be written.
-                if (argv.convert && inFilename && !argv.o) {
+                if (argv.convert && inFilename && !argv.outFile) {
                     const parsedFilename = path.parse(inFilename)
                     const outFilename = path.format(
                         Object.assign(
@@ -75,8 +55,8 @@ if (argv.version) {
                     )
 
                     writeStream = fs.createWriteStream(outFilename)
-                } else if (argv.o) {
-                    writeStream = fs.createWriteStream(argv.o)
+                } else if (argv.outFile) {
+                    writeStream = fs.createWriteStream(argv.outFile)
                 } else {
                     writeStream = process.stdout
                 }
@@ -90,6 +70,66 @@ if (argv.version) {
     })
 }
 
+function parseArgs () {
+    let convert
+    let space
+    let validate
+    let outFile
+    let version
+    let help
+    const defaults = []
+
+    const args = process.argv.slice(2)
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i]
+        switch (arg) {
+        case '--convert':
+        case '-c':
+            convert = true
+            break
+
+        case '--space':
+        case '-s':
+            space = args[++i]
+            break
+
+        case '--validate':
+        case '-v':
+            validate = true
+            break
+
+        case '--out-file':
+        case '-o':
+            outFile = args[++i]
+            break
+
+        case '--version':
+        case '-V':
+            version = true
+            break
+
+        case '--help':
+        case '-h':
+            help = true
+            break
+
+        default:
+            defaults.push(arg)
+            break
+        }
+    }
+
+    return {
+        convert,
+        space,
+        validate,
+        outFile,
+        version,
+        help,
+        defaults,
+    }
+}
+
 function version () {
     console.log(pkg.version)
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "json5",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "JSON for humans.",
   "main": "lib/index.js",
   "module": "dist/index.mjs",
@@ -48,9 +48,6 @@
     "url": "https://github.com/json5/json5/issues"
   },
   "homepage": "http://json5.org/",
-  "dependencies": {
-    "minimist": "^1.2.5"
-  },
   "devDependencies": {
     "core-js": "^2.6.5",
     "eslint": "^5.15.3",

package.json5

@@ -1,7 +1,7 @@
 // This is a generated file. Do not edit.
 {
   name: 'json5',
-  version: '2.2.0',
+  version: '2.2.1',
   description: 'JSON for humans.',
   main: 'lib/index.js',
   module: 'dist/index.mjs',
@@ -49,9 +49,6 @@
     url: 'https://github.com/json5/json5/issues',
   },
   homepage: 'http://json5.org/',
-  dependencies: {
-    minimist: '^1.2.5',
-  },
   devDependencies: {
     'core-js': '^2.6.5',
     eslint: '^5.15.3',