BSON, a library for parsing and generating BSON (Binary JSON) data, saw a version update from 0.1.1 to 0.1.3. Both versions are described as BSON parsers designed for use in Node.js and browser environments.
A notable difference between the two versions is the introduction of a "dependencies" field in version 0.1.3. Version 0.1.1 does not list any dependencies, implying a reliance solely on built-in JavaScript functionalities or peer dependencies managed externally. While the specifics of the dependency (or dependencies) introduced in 0.1.3 are not explicitly mentioned in the provided data, this could indicate added functionality or improved performance through leveraging another library - something worth investigating for developers considering the upgrade. Both versions share the same development dependencies: "gleak" (likely used for memory leak detection) and "nodeunit" (a unit testing framework).
Both versions retain the same author and repository information indicating continuity in development and maintainership by Christian Amor Kvalheim and the mongodb/js-bson project. This provides assurance of ongoing support and a stable codebase. The "dist" field, containing the location of the tarball, confirms that both versions are available via the npm registry, simplifying installation and integration into existing projects. The update from 0.1.1 (released August 27, 2012) to 0.1.3 (released September 25, 2012) suggests a relatively short period between releases, hinting at bug fixes, performance tweaks, or minor feature additions included with the dependency added on the newer version. Developers should evaluate the dependency introduced in 0.1.3 to determine if the benefits outweigh any potential compatibility concerns.
All the vulnerabilities related to the version 0.1.3 of the package
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
