Parse-url is a versatile npm package designed for robust URL parsing, including support for git URLs. Version 5.0.8 introduces notable updates compared to the previous stable release, 5.0.7. A key difference lies in the dependencies: version 5.0.8 upgrades "parse-path" from version 4.0.0 to 4.0.4 and "normalize-url" from version 4.5.1 to a more recent version 6.1.0. These dependency updates potentially bring improvements regarding URL normalization and path handling, which could include enhanced security measures, better support for edge cases, and potential bug fixes inherent in those updated sub-modules.
Developers utilizing parse-url should consider upgrading to version 5.0.8 to benefit from these enhancements. The update of 'normalize-url' is particularly significant as this module is responsible for cleaning and standardizing URLs, a process crucial for security and data consistency. The jump from version 4.5.1 to 6.1.0 suggests potentially substantial improvements in the normalization logic. Version 5.0.8 also introduces an increase in "unpackedSize" suggesting more code which could correspond to more features, improved performance, or more comprehensive tests. Before upgrading, developers should review the changelogs of "parse-path" and "normalize-url" to understand the specific changes and ensure compatibility with their existing code. The "releaseDate" difference indicates a substantial time gap between the versions and the updates are important for applications relying on accurate and secure URL parsing.
All the vulnerabilities related to the version 5.0.8 of the package
Hostname confusion in parse-url
Exposure of Sensitive Information to an Unauthorized Actor via hostname confusion in GitHub repository ionicabizau/parse-url prior to 6.0.1
Server-Side Request Forgery in parse-url
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Cross site scripting in parse-url
Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Cross site scripting in parse-url
Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 6.0.1
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing
parse-url prior to 8.1.0 is vulnerable to Misinterpretation of Input. parse-url parses certain http or https URLs incorrectly, identifying the URL's protocol as ssh. It may also parse the host name incorrectly.
Authorization Bypass in parse-path
Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.
