Dust.js is a powerful templating engine originally developed by LinkedIn, designed for both browser and Node.js environments. Versions 2.1.3 and 2.1.4 offer developers asynchronous templating capabilities, enabling efficient rendering of dynamic content. Both versions share core features, including the MIT license, ensuring freedom in usage and modification. They also rely on the same set of development dependencies such as "pegjs" for parser generation, "uglify-js" for minifying the code, "jasmine-node" for testing purposes and "cover" for checking the test coverage.
The key difference lies in their release dates. Version 2.1.4 was released on March 6, 2014, subsequent to version 2.1.3, which was released on February 28, 2014. While the provided data doesn't explicitly detail the specific code changes or bug fixes introduced in version 2.1.4, the later release date suggests improvements, bug fixes, or minor feature enhancements compared to its predecessor. Developers should consider checking the project's GitHub repository for a comprehensive changelog outlining the specific modifications made in version 2.1.4.
For developers seeking a reliable and actively maintained templating solution, Dust.js offers a robust option, but it's important to note that, according to the provided information, the versions mentioned are quite old. For new projects you should check out the more recent versions.
All the vulnerabilities related to the version 2.1.4 of the package
dustjs-linkedin vulnerable to Prototype Pollution
A vulnerability was found in LinkedIn dustjs prior to version 3.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0 can address this issue. The name of the patch is ddb6523832465d38c9d80189e9de60519ac307c3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216464.
