EJS (Embedded JavaScript templates) is a simple templating language that lets you generate HTML markup with plain JavaScript. Version 2.5.9 refines this approach, building upon the established foundation of version 2.5.8 with several key updates. Developers who rely on EJS for dynamic content generation will want to note the changes primarily reside in the development dependencies, suggesting a focus on improvements to the development workflow and testing.
Specifically, version 2.5.9 upgrades several development tools. The 'mocha' testing framework jumps from version 3.0.2 to version 5.0.5, enabling usage of the newest capabilities and maybe fixing compatibilities with other packages. Additionally, 'uglify-js', a minifier for Javascript, is updated from version 2.6.2 to version 3.3.16. The bump from version 13.0.1 -> 13.1.1 in 'browserify' ensures developers are leveraging the latest bundling capabilities for browser-based applications. Finally, the releaseDate changes and potentially there are some bug fixes and performance optimizations that were introduced within the context of refactoring or upgrading dependencies. Considering the unpackedSize of the package has slightly increased between the 2 versions, developers can expect small differences in the package size as well. While the core templating functionality remains consistent, these upgrades offer indirect benefits to developers. Improved testing, minification, and bundling processes make for a more robust and efficient development cycle. Developers should therefore consider upgrading to version 2.5.9 to take advantage of these enhancements in their templating workflow.
All the vulnerabilities related to the version 2.5.9 of the package
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).