Log4js, a popular logging library for Node.js, saw a minor version update from 4.5.0 to 4.5.1 in July 2019. While the core functionality remains consistent, a closer look reveals subtle yet important differences for developers. Both versions maintain the same core dependencies, including date-format, debug, flatted, and rfdc, crucial for formatting dates, debugging, handling circular references in objects, and deep cloning, respectively. However, the streamroller dependency experiences a bump from version 1.0.5 to 1.0.6. Streamroller is responsible to manage log files efficiently by managing their size and rollover, and this update might contain bug fixes or minor enhancements in that functionality related to file management.
The developer dependencies, essential for development and testing, remain unchanged, indicating a focus on internal improvements or bug fixes rather than introducing new features. Libraries like eslint, husky, nyc, and typescript ensure code quality, consistent styling, pre-commit hooks, test coverage, and type safety. Users upgrading should specifically review changes in streamroller to ensure compatibility with their existing log rotation strategies and benefits from bug fixes and improvements. The difference in unpacked size (99792 vs 99294) suggests minor code optimization or adjustments.
All the vulnerabilities related to the version 4.5.1 of the package
Incorrect Default Permissions in log4js
Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.
Fixed by:
Released to NPM in log4js@6.4.0
Every version of log4js published allows passing the mode parameter to the configuration of file appenders, see the documentation for details.
Thanks to ranjit-git for raising the issue, and to @lamweili for fixing the problem.
If you have any questions or comments about this advisory: