Conventional-github-releaser simplifies the process of creating GitHub releases directly from your Git metadata, automating a crucial part of the release workflow. Comparing version 1.1.2 with the previous stable version, 1.1.1, reveals subtle but potentially important changes. The core functionality remains consistent and continues to provide tools for generating release notes based on conventional commits.
Both versions share the same key dependencies, including "conventional-changelog" for generating changelogs, "github" for interacting with the GitHub API, and "semver" for semantic versioning. The development dependencies also remain unchanged, indicating a focus on maintaining code quality and test coverage without introducing new testing frameworks. A notable difference lies in the repository URL. Version 1.1.2 points to https://github.com/conventional-changelog/conventional-github-releaser.git, while version 1.1.1 points to https://github.com/stevemao/conventional-github-releaser.git, suggesting a transfer of ownership or a move to a dedicated organization for conventional changelog tools. This change is significant because it might indicate a larger community effort and potentially more active maintenance and feature development in the future. The later release date of version 1.1.2, April 17, 2016, compared to February 29, 2016, for version 1.1.1 show a more up-to-date version. Therefore, developers should prefer the newer version to benefit from any bug fixes, security updates that might be related to the org change, and potential alignment with the broader conventional-changelog ecosystem.
All the vulnerabilities related to the version 1.1.2 of the package
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
dot-prop Prototype Pollution vulnerability
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Uncontrolled Resource Consumption in trim-newlines
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
