EJS (Embedded JavaScript templates) offers a simple way to generate HTML markup with plain JavaScript. Examining versions 3.1.3 and 3.1.2 reveals a subtle evolution of this popular templating engine. Both versions share core dependencies like Jake for build automation and development tools such as JSDoc for documentation, Mocha for testing, ESLint for code linting, LRU-Cache for optimization, Uglify-js to minify javascript code, Browserify to write Node.js-style modules that compile for usage in the browser and Git-directory-deploy for simplifying deployment. This indicates a consistent development environment focused on code quality and performance. The key difference lies in the "dist" object. Version 3.1.3 has a larger unpacked size (133861 bytes) and filecount (14 files) compared to version 3.1.2 (127388 bytes and 13 files). This size increase suggests potential additions, bug fixes, or performance improvements within the newer version. Developers should investigate the changelog (usually available on the EJS GitHub repository) for detailed information on these modifications. Furthermore, the release date difference indicates that version 3.1.3 was released approximately three weeks after 3.1.2, implying that it could contain essential fixes or valuable updates that make it a worthwhile upgrade. When adopting either version, ensuring dependency compatibility with other projects is essential and using the latest stable release is generally recommended for optimal results.
All the vulnerabilities related to the version 3.1.3 of the package
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).