EJS (Embedded JavaScript) is a simple templating engine that lets you generate HTML markup with plain JavaScript. Looking at versions 2.6.1 and 2.5.9, developers will notice a few key changes. The core functionality remains the same: EJS allows you to embed JavaScript directly into HTML, making it ideal for dynamic content generation in Node.js applications or even directly in the browser.
A primary difference between the two versions lies in the dist section, specifically the unpackedSize. Version 2.6.1 weighs in at 120006 bytes unpacked, whereas version 2.5.9 has an unpacked size of 116962 bytes. This indicates that version 2.6.1 includes some added features or refactorings that lead to this slight increase in size. The releaseDate also differs, telling us that version 2.6.1 was released about 2 weeks later than version 2.5.9, it means it addressed the bugs of the previous version.
Both versions share the same dependencies and development dependencies, meaning that the core development workflow and tooling didn't see any major changes between these releases. Tools such as Jake for build automation, JSDoc for documentation, Mocha for testing, ESLint for linting, Istanbul for code coverage, and UglifyJS for minification remained consistent. This signals stability in the underlying development practices. The fileCount being 10 in both versions also indicates no structural changes were performed in the project. For developers, this means a smooth transition to version 2.6.1 is possible, with the added benefit of bug fixes made by the maintainers. While the changes might seem small, staying updated with the latest minor version ensures access to potential performance improvements and important security patches.
All the vulnerabilities related to the version 2.6.1 of the package
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).