EJS (Embedded JavaScript) is a popular templating engine for JavaScript that allows developers to generate dynamic HTML content on both the server-side and client-side. Comparing versions 3.1.5 and 3.1.4 reveals a subtle but crucial update timeline. Both versions share identical dependencies, including "jake" for build automation, and development dependencies like "jsdoc" for documentation, "mocha" for testing, "eslint" for code linting, "lru-cache" for caching, "uglify-js" for minification, "browserify" for bundling, and "git-directory-deploy" for deployment. This consistency suggests that the core functionality and development workflow remain unchanged between these versions.
The key difference lies in the releaseDate. Version 3.1.5 was released moments later than 3.1.4. While the specific nature of the update between these two versions is not explicit from this data, the very close release times suggest version 3.1.5 likely contains a minor bug fix, a patch addressing a small issue that didn't warrant a major or minor version bump. Developers already using EJS 3.1.4 should consider upgrading to 3.1.5 to benefit from the latest, potentially improved, stable version. New users can confidently use either, but are generally recommended to use the newest, 3.1.5, to ensure they have the most up-to-date and reliable experience. Both versions share the same file count and unpacked size indicating that the update was targeted on a minor aspect of the code. The Apache-2.0 license continues to apply, offering developers flexibility in using and modifying the library.
All the vulnerabilities related to the version 3.1.5 of the package
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).