EJS (Embedded JavaScript templates) offers a simple way to generate dynamic HTML content. Comparing versions 3.1.3 and 3.1.4, we see that both share the same core dependencies, including "jake" for build automation, and development dependencies like "jsdoc" for documentation, "mocha" for testing, "eslint" for code linting, "lru-cache," "uglify-js," "browserify," and "git-directory-deploy". This indicates a consistent development environment across these releases, focused on maintaining code quality and build processes.
The key difference lies in the dist section and releaseDate. Version 3.1.4 was released on August 17, 2020, while 3.1.3 came out on May 17, 2020, suggesting a few months of development and potential bug fixes or minor improvements. Intriguingly, version 3.1.4 has a slightly smaller fileCount (13 vs. 14) and a marginally larger unpackedSize (133934 vs. 133861). This could reflect optimizations in file structure or the inclusion of new features that contribute a small amount of code.
For developers, this data implies a stable and actively maintained templating engine. The consistent dependency versions ensure compatibility with existing build pipelines. The release date difference highlights the project's ongoing commitment to refinement. Although the exact nature of changes between 3.1.3 and 3.1.4 isn't explicitly stated in this data, the slight differences in fileCount and unpackedSize suggest that developers should consult the changelog (if available) for specific details on potential bug fixes or minor enhancements introduced in version 3.1.4. Overall, EJS remains a reliable choice for generating dynamic HTML within Node.js and browser environments, offering a lightweight and flexible templating solution.
All the vulnerabilities related to the version 3.1.4 of the package
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).