Gulp-notify is a handy tool for Gulp users who want to receive notifications about their build process directly in their operating system. Both versions 1.2.0 and 1.1.1 provide this core functionality, delivering messages to the Mac Notification Center or Linux' notify-send. Examining the package information reveals they share identical dependencies: through2, gulp-util, node-notifier, and lodash.template, ensuring a consistent approach to stream handling, utility functions, system notifications, and template processing. Similarly, the development dependencies, comprising gulp, mocha, should, and gulp-plumber, are the same which guarantees continuous integration processes remain stable with both versions.
The key difference lies in the release date and potentially internal tweaks not explicitly detailed within the provided metadata. Version 1.2.0 was published on March 12, 2014, a few days after version 1.1.1, which was released on March 9, 2014. While the update appears minor, developers should consider upgrading to the newest version as it may contain bug fixes, performance improvements, or enhancements to notification handling. When upgrading packages through NPM, especially the older ones, make sure to test it thoroughly and to check the changelog for possible breaking changes. It's highly advisable to consult the changelog or repository commit history for a deeper understanding of the specific changes incorporated in version 1.2.0. Given that both versions share the same dependencies, the upgrade is likely non-disruptive if no breaking changes are present.
All the vulnerabilities related to the version 1.2.0 of the package
Uncontrolled Resource Consumption in trim-newlines
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end()
method.
OS Command Injection in node-notifier
This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.
Command Injection in lodash
lodash
versions prior to 4.17.21 are vulnerable to Command Injection via the template function.