EJS (Embedded JavaScript templates) offers a streamlined way to generate dynamic HTML content within Node.js and the browser. Comparing versions 3.0.1 and 3.0.2, the core functionality and developer experience remain largely consistent. Both iterations share identical dependencies and development dependencies, employing tools like Jake for build automation, JSDoc for documentation, Mocha for testing, ESLint for code linting, and UglifyJS for minification. Developers familiar with one version will seamlessly transition to the other.
The primary distinction lies in a slight increase in the unpacked size of the package, with version 3.0.2 measuring 118654 bytes compared to version 3.0.1's 118237 bytes. This suggests minor code adjustments or optimizations occurred between releases, potentially addressing edge cases or subtle performance improvements. While the file count remains constant at 11, hinting at no significant architectural changes, This also means the install size increases slightly, although it shouldn't have an impact in normal usage. Another significant difference is the release date - version 3.0.2 was released on March 29, 2020, while version 3.0.1 was released much earlier, on November 24, 2019.
For developers, EJS continues to provide a simple and efficient templating solution. Its straightforward syntax allows dynamic content insertion, control structures, and reuse of components, making it ideal for generating web pages, emails, and other dynamic content. Consider upgrading to the latest version to benefit from potential bug fixes and optimizations, while maintaining familiarity with the well-established EJS ecosystem.
All the vulnerabilities related to the version 3.0.2 of the package
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).