Webpack version 0.2.0, released on March 14, 2012, represents a subtle evolution from its predecessor, version 0.1.6, released just two days prior on March 12, 2012. Both versions are tailored for developers seeking to streamline JavaScript module bundling for browser deployment. They share core functionality, effectively packaging CommonJS modules and enabling code splitting into multiple bundles for on-demand loading – a feature that significantly improves initial page load times and user experience. The dependency structure remains identical, relying on esprima for JavaScript parsing, optimist for command-line argument parsing, and uglify-js for code minification. Developers familiar with webpack's core concepts from version 0.1.6 will find a seamless transition to version 0.2.0.
While the functional differences between these versions are not explicitly detailed in the provided metadata, the rapid release suggests potential bug fixes, minor improvements, or internal refactoring. For developers embarking on new projects, choosing the slightly newer version 0.2.0 is generally advisable, assuming it inherits the stability of 0.1.6 but potentially incorporates enhancements. Existing projects using 0.1.6 might consider upgrading if encountering specific issues addressed in the newer release, albeit with standard testing procedures to ensure compatibility. Both versions, authored by Tobias Koppers, provide a foundational layer for managing JavaScript dependencies in a browser environment.
All the vulnerabilities related to the version 0.2.0 of the package
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Upgrade UglifyJS to version >= 2.4.24.
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.