EJS (Embedded JavaScript templates) version 3.1.6 presents a very incremental update over the previous stable release, version 3.1.5. Both versions share the same core dependencies, jake for build automation, and identical development dependencies like jsdoc for documentation, mocha for testing, eslint for code linting, lru-cache for caching, uglify-js for minification, browserify for bundling, and git-directory-deploy for deployment. This suggests a continuous commitment to code quality, testing, and documentation throughout the library's development. The license remains Apache-2.0. Also, the repository and author information are unchanged, indicating consistent maintainership.
The most noticeable difference lies in the dist section, specifically under unpackedSize, where version 3.1.6 has a slightly larger unpacked size of 134358 compared to 3.1.5 at 133934. This small increase may point to minor code additions, bug fixes, or improvements within the templating engine that were added without bumping the minor version. Also, the releaseDate clearly shows that version 3.1.6 was released later. Besides this, almost all aspects reported in the provided data are the same between the 2 packages.
For developers choosing between these versions, the practical impact is minimal. Both offer a reliable and well-tested templating solution. Upgrading to 3.1.6 is recommended for accessing the very latest refinements and potentially benefiting from any addressed bugs, although the changes appear subtle. Always consult the EJS changelog or commit history for a detailed breakdown of specific modifications between these versions.
All the vulnerabilities related to the version 3.1.6 of the package
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).