The npm package semver, a crucial tool for semantic version parsing used extensively within the npm ecosystem, saw a minor version update from 1.1.2 to 1.1.3 in early 2013. Both versions share the same fundamental characteristics: they are described as "The semantic version parser used by npm," indicating their primary function and importance for managing dependencies in JavaScript projects. They also share the same MIT license, ensuring developers have broad permissions for usage, modification, and distribution. The source code repository remains consistent, residing on GitHub under isaacs/node-semver, allowing developers to contribute and inspect the codebase. The dependency tap for testing purposes remains the same too.
The most apparent difference between versions 1.1.2 and 1.1.3 is the release date. Version 1.1.2 was released on January 6, 2013, whereas version 1.1.3 followed about a month later, on February 6, 2013. Because of this short time it's reasonable to think a developer might want to investigate the changelog for specific bug fixes or minor improvements introduced in the 1.1.3 release. The semantic versioning scheme suggests that the jump from 1.1.2 to 1.1.3 includes at least one bug fix or minor feature. Developers already using semver should consider upgrading to benefit from these latest improvements and fixes while developers new to the library can safely use the latest version 1.1.3.
All the vulnerabilities related to the version 1.1.3 of the package
Regular Expression Denial of Service in semver
Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Update to version 4.3.2 or later
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
