Semver, a crucial package widely used in the Node.js ecosystem for semantic version parsing, underwent a subtle but important update from version 3.0.0 to 3.0.1. Both versions, sharing the same core functionality as the semantic version parser used by npm, specify development dependencies on the tap testing framework (version 0.x, requiring at least 0.0.4) and uglify-js (version ~2.3.6) for minification during development. Licensed under the BSD license, emphasizing its open-source nature, the package's source code resides in a Git repository on GitHub under the isaacs/node-semver path.
The most notable distinction lies in the release date and, presumably, the fixes or improvements incorporated. Version 3.0.0 was released on July 23, 2014, while version 3.0.1 followed closely on July 24, 2014. This short interval suggests that version 3.0.1 likely addresses a bug fix or a minor enhancement discovered shortly after the initial 3.0.0 release. While the package description remains identical, developers should prefer 3.0.1 because it is likely more stable and handles edge cases better. Developers integrating semver into their projects should favor the latest patch release (3.0.1 in this case) within the same minor version to benefit from these improvements, ultimately ensuring greater reliability and compatibility when managing dependencies in their Node.js applications. The package is available through the npm registry as a tarball: https://registry.npmjs.org/semver/-/semver-3.0.1.tgz
All the vulnerabilities related to the version 3.0.1 of the package
Regular Expression Denial of Service in semver
Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Update to version 4.3.2 or later
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
