Conventional-github-releaser, a tool for automating GitHub release creation from git metadata, saw a minor update from version 3.1.4 to 3.1.5. Both versions share the core functionality of streamlining the release process and depend on essential packages like conventional-changelog for changelog generation, gh-got for GitHub API interaction, and git-semver-tags for semantic version tag retrieval. Examining the package manifests reveals that the dependency list remains identical, including crucial utilities like lodash.merge, meow for command-line interface handling, and semver for version management. The license remains MIT, ensuring open-source usability.
The key difference lies in the updated distribution metadata. Version 3.1.5, released on July 5th, 2020, exhibits a slightly larger unpacked size of 26445 bytes compared to version 3.1.4's 26190 bytes, released on June 25th, 2020. This marginal size increase, though minor, suggests potential internal code adjustments, bug fixes, or performance enhancements within the newer release. Developers considering upgrading should note this subtle change; while the core dependencies remain the same, the underlying implementation might offer improved stability or efficiency. For those consistently utilizing conventional-github-releaser in their CI/CD pipelines, updating to 3.1.5 is recommended to benefit from these potential improvements, ensuring a smooth and automated release workflow on GitHub. Reviewing the release notes or commit history (available on the GitHub repository) associated with version 3.1.5 would provide further clarity on the specific changes implemented.
All the vulnerabilities related to the version 3.1.5 of the package
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Got allows a redirect to a UNIX socket
The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket.
http-cache-semantics vulnerable to Regular Expression Denial of Service
http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
semver-regex Regular Expression Denial of Service (ReDOS)
npm semver-regex is vulnerable to Inefficient Regular Expression Complexity
Regular expression denial of service in semver-regex
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
