Semantic-release, a tool for automating package publishing with semantic versioning, saw a release of version 1.2.0 shortly after version 1.1.1. Examining the metadata, the core functionalities and listed dependencies appear identical between the two versions. Both rely on packages like "github" for interacting with GitHub, "semver" for handling semantic versioning, and "conventional-changelog" for generating changelogs. This suggests that the underlying mechanism for analyzing commit history and determining the next version number remained consistent. Similarly, the developer dependencies, specifically "standard" for code linting, remained the same, indicating a continuing commitment to code quality.
The really notable difference lies in the release date. Version 1.2.0 was published on February 2nd, 2015 at 22:37:17 GMT, while version 1.1.1 was published earlier the same day at 17:07:17 GMT. This relatively short gap between releases strongly suggests that version 1.2.0 likely contains bug fixes or minor improvements upon version 1.1.1. While the specific nature of these changes isn't detailed in the metadata alone, developers using semantic-release should strongly consider upgrading to version 1.2.0 to benefit from these potential stability enhancements and improvements. Given the identical dependencies, the update path should be straightforward. The small release time may suggest the presence of a bug uncovered shortly after releasing 1.1.1 The tarball URLs provided point to the specific package versions on the npm registry for seamless integration into development workflows.
All the vulnerabilities related to the version 1.2.0 of the package
Secret disclosure when containing characters that become URI encoded
Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL.
Fixed in v17.2.3
Secrets that do not contain characters that become encoded when included in a URL are already masked properly.
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
