Bson versions 0.1.3 and 0.1.4 represent incremental updates to a crucial BSON parser library designed for both Node.js and browser environments. Both versions share the same core purpose: facilitating the encoding and decoding of BSON (Binary JSON) data, a binary serialization format used extensively with MongoDB. Developers reliant on MongoDB and requiring BSON manipulation in their JavaScript applications will find these versions relevant.
Key similarities exist. The "description," highlighting its role as a BSON parser, remains consistent. Both versions depend on the same development dependencies, gleak (for memory leak detection) and nodeunit (for unit testing), suggesting a continuous focus on code quality. The author, Christian Amor Kvalheim, is also unchanged.
The primary noticeable difference between the two versions lies in the *repository URL* within the repository field. 0.1.3 uses the SSH-based URL git@github.com:mongodb/js-bson.git, while 0.1.4 adopts the HTTPS-based URL git://github.com/mongodb/js-bson.git. This switch suggests a move, possibly to enable wider accessibility and easier cloning without SSH key configuration. This could simplify contributing. Furthermore, the release date indicates a small gap between the two: 0.1.3 was released on September 25, 2012, and 0.1.4 on September 29, 2012, a turnaround of about 4 days suggesting a rapid fix or minor improvement. This quick patch might address a small edge case issue reported by users. Developers should upgrade to the latest version as a precaution.
All the vulnerabilities related to the version 0.1.4 of the package
Deserialization of Untrusted Data in bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.
