EJS (Embedded JavaScript templates) offers a simple way to generate dynamic HTML content within JavaScript applications. Comparing version 2.7.1 to its predecessor, 2.6.2, reveals subtle but potentially impactful changes for developers. Both versions share identical dependencies and development dependencies, including tools like Jake for build automation, JSDoc for documentation, Mocha for testing, and ESLint for linting. Key packages for minification (uglify-js), browser bundling (browserify) and coverage reports(istanbul) remain untouched, indicating a consistent development workflow. The core functionality related to template rendering appears stable between versions.
The notable differences are found in the dist object. Version 2.7.1 has a slightly larger unpacked size of 122099 bytes, compared to 121906 bytes in version 2.6.2. This difference of approximately 200 bytes suggests minor code improvements, bug fixes, or updates to documentation or supporting files rather than a significant feature overhaul. The release date indicates version 2.7.1 was published roughly two and a half months after 2.6.2.
Developers already using EJS will find the upgrade straightforward, unlikely to introduce breaking changes. New users can confidently start with either version, but choosing 2.7.1 is generally preferred for its incremental improvements and potential bug fixes accumulated since the previous release. EJS continues to provide a lightweight, dependency-free templating solution suitable for both server-side and client-side JavaScript environments.
All the vulnerabilities related to the version 2.7.1 of the package
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).