Brace expansion, a handy JavaScript library emulating the brace expansion feature familiar to users of sh/bash shells, saw a minor but potentially impactful update moving from version 1.1.9 to 1.1.10. Both versions maintain the same core functionality: expanding brace patterns into a list of strings. They share identical dependencies, relying on concat-map for efficient array concatenation and balanced-match for accurate matching of potentially nested braces. Similarly, the development dependencies, tape for testing and matcha for benchmarking, remained unchanged, assuring developers of continued testing rigor. The license, author, and repository details also persist across versions.
The key differences between version 1.1.9 and 1.1.10 are subtle yet important. Version 1.1.10 was released on February 9, 2018, at 21:13:29.675Z, a little more than 11 hours after the release of version 1.1.9. But the more important is the difference of approximately 1KB in the unpacked size of the package (10964 vs 9867) and the increase in the file count (4 vs 3). This suggests that while the core code and dependencies are the same, version 1.1.10 likely incorporates minor bug fixes, performance improvements, or documentation updates that contribute to the larger package size and extra file. Developers should consider upgrading to version 1.1.10 to benefit from these potential enhancements and ensure they are using the most up-to-date version of the library.
All the vulnerabilities related to the version 1.1.10 of the package
brace-expansion Regular Expression Denial of Service vulnerability
A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5
. It is recommended to upgrade the affected component.