node-jose - npm Package Compare versions

Comparing version 0.11.0 to 0.11.1

CHANGELOG.md

@@ -0,1 +1,14 @@
+# Release Notes
+
+<a name="0.11.1"></a>
+## [0.11.1](https://github.com/cisco/node-jose/compare/0.11.0...0.11.1) (2018-05-15)
+
+**NOTE:** This is a security patch, replacing `base64url` with `b64u` to address a [vulnerability in the previous dependency](https://hackerone.com/reports/321687).
+
+### Chore
+
+* replace base64url with b64u (#179) ([7f88049af5de3593adc00d886150bf2fa8f1ecd4](https://github.com/cisco/node-jose/commit/7f88049af5de3593adc00d886150bf2fa8f1ecd4)), closes [#179](https://github.com/cisco/node-jose/issues/179)
+
+
+
 <a name="0.11.0"></a>
@@ -36,4 +49,2 @@ # [0.11.0](https://github.com/cisco/node-jose/compare/0.10.0...0.11.0) (2017-11-30)
 
-# Release Notes
-
 <a name="0.9.5"></a>
@@ -40,0 +51,0 @@ ## [0.9.5](https://github.com/cisco/node-jose/compare/0.9.4...0.9.5) (2017-08-07)

lib/util/base64url.js

@@ -8,4 +8,9 @@ /*!
 
-var impl = require("base64url");
+var impl = require("b64u");
 
+// webpack specific
+if (impl.default) {
+  impl = impl.default;
+}
+
 /**
@@ -12,0 +17,0 @@ * @namespace base64url

package.json

 {
   "name": "node-jose",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "A JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers",
@@ -29,3 +29,3 @@ "main": "lib/index.js",
   "dependencies": {
-    "base64url": "^2.0.0",
+    "b64u": "^2.0.0",
     "es6-promise": "^4.0.5",
@@ -32,0 +32,0 @@ "lodash.assign": "^4.0.8",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

336984

increased by0.17%

Lines of code

9635

increased by0.04%

Dependency changes

• + Addedb64u@^2.0.0

• + Addedb64u@2.0.0(transitive)

• - Removedbase64url@^2.0.0

• - Removedbase64url@2.0.0(transitive)