Mversion is a versatile command-line tool designed to streamline the process of managing and updating package versions across various packaging managers. Comparing version 2.0.1 with its predecessor, 2.0.0, reveals subtle yet crucial improvements for developers. Both versions share the core functionality of handling module versioning, boasting a robust set of dependencies like chalk for enhanced terminal output, cli-usage for user-friendly command-line interface, semver for semantic versioning compliance, and vinyl-fs for file system operations. These ensure a smooth and reliable version bumping experience.
The key difference lies in the details: version 2.0.1 was released on June 30, 2020, a couple of weeks after version 2.0.0 which was released on June 15, 2020. The unpacked size is slightly bigger in the newest version, with an increase of 14 bytes, from 27559 to 27573. While seemingly minor, this likely indicates bug fixes, performance tweaks, or refined functionality. For developers, upgrading to 2.0.1 offers the assurance of a more polished and potentially more stable version. The mversion tool continues to provide a consistent interface for incrementing versions, modifying package files, and generating changelogs, simplifying the release management workflow. Using mversion saves valuable time and reduces manual errors, ensuring consistent versioning practices across projects. Both versions are licensed under the permissive MIT license and available on GitHub, and the differences between the 2 releases are really minimal.
All the vulnerabilities related to the version 2.0.1 of the package
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Got allows a redirect to a UNIX socket
The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket.