Coffee-coverage is a valuable tool for JavaScript developers working with CoffeeScript, providing JSCoverage-style instrumentation to analyze code coverage. Comparing versions 0.4.3 and 0.4.4 highlights subtle but important updates impacting developers. Both versions share the core functionality of instrumenting CoffeeScript files for coverage analysis, along with key dependencies like pkginfo and coffee-script for package information and CoffeeScript compilation, respectively.
However, version 0.4.4 introduces an updated dependency on argparse, moving from ">=0.1.7" to "^0.1.16". This suggests a dependency update focused on stability and potentially bug fixes within the argparse library which will affects how command line arguments are managed. Additionally, the development dependency mocha sees a significant version jump, upgrading from "1.15.0" to "^2.1.0". This upgrade likely incorporates improvements in Mocha's testing framework, giving developers more robust and modern testing capabilities. While the core features remain consistent, the updated dependencies in version 0.4.4 indicate a focus on improved stability, updated command-line argument parsing, and modernized testing environments, offering a slightly refined developer experience compared to version 0.4.3. Developers should consider these dependency updates when choosing a version, particularly if their existing testing or argument parsing relies on specific behaviors of the older dependency versions.
All the vulnerabilities related to the version 0.4.4 of the package
Arbitrary Code Execution in underscore
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Regular Expression Denial of Service in underscore.string
Versions of underscore.string prior to 3.3.5 are vulnerable to Regular Expression Denial of Service (ReDoS).
The function unescapeHTML is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.
Upgrade to version 3.3.5 or higher.
