Conventional Github Releaser, a tool designed to automate the creation of GitHub releases using Git metadata, saw a minor update from version 1.1.2 to 1.1.3. Both versions share the same core functionality: generating release notes based on conventional changelog standards. Key dependencies like conventional-changelog, dateformat, git-semver-tags, github, lodash.merge, meow, object-assign, q, semver, and through2 remain consistent, ensuring a stable foundation for release generation. The development dependencies including chai, concat-stream, coveralls, github-remove-all-releases, istanbul, jscs, jshint, mocha and shelljs also did not change between the versions.
The primary difference between versions 1.1.2 and 1.1.3 lies in the release date. Version 1.1.2 was released on April 17, 2016, whereas version 1.1.3 was released on June 14, 2016. This suggests that the update might include minor bug fixes, performance improvements, or dependency updates not reflected in the declared dependencies. Developers leveraging this tool should consider upgrading to the latest version (1.1.3) to benefit from any underlying refinements and to ensure compatibility with the broader ecosystem. Due to its role in automating release management and its adherence to conventional changelog practices, it remains a reliable option for developers seeking to streamline their release workflows.
All the vulnerabilities related to the version 1.1.3 of the package
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
dot-prop Prototype Pollution vulnerability
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Uncontrolled Resource Consumption in trim-newlines
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
