Serve-index is a valuable Node.js middleware for creating directory listings in web applications. Version 1.1.0 introduces noteworthy changes compared to the prior stable version 1.0.3, impacting dependency management and potentially influencing development workflows. Specifically, version 1.1.0 replaces the negotiator dependency (version 0.4.3) with accepts (version 1.0.2). This swap likely addresses content negotiation and request header parsing using a different library. Developers should investigate accepts' handling of HTTP Accept headers to ensure compatibility with their application's content negotiation strategy.
Furthermore, the development dependencies have been significantly updated. Mocha is bumped from ~1.17.1 to ~1.20.0, Should.js from ~3.1.3 to ~4.0.0, Connect is removed, Istanbul is added at version 0.2.10, and Supertest is updated from ~0.9.0 to ~0.13.0. These changes suggest improvements in the testing suite, coverage reporting and overall stability. The removal of Connect and the addition of Istanbul, in particular, suggest a modernization of the testing infrastructure focusing on code coverage analysis. Developers upgrading should be aware of potential breaking changes in the updated versions of Mocha, Should.js, and Supertest, and should review their existing test suites accordingly. These changes collectively point towards a more robust and well-tested version of the serve-index package.
All the vulnerabilities related to the version 1.1.0 of the package
Cross-Site Scripting in serve-index
Versions 1.6.2 and earlier of serve-index are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module's HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application.
Update to version 1.6.3 or later.
mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input
Affected versions of mime are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Update to version 2.0.3 or later.
Regular Expression Denial of Service in negotiator
Affected versions of negotiator are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted Accept-Language header value.
Update to version 0.6.1 or later.
