Publish new version with recent changes to address security vulnerability

[mannybecerra]

Hi all,

I'm checking to confirm if the most current version of expr-eval is published to npm?

• Last version appears to have been published 2-years ago, according to npm https://www.npmjs.com/package/expr-eval
• There's a more current change here, https://github.com/silentmatt/expr-eval/blob/master/src/evaluate.js#L44, that appears to have come-in within the past 2-years
• The change in reference appears to address an issue that we'd like to have, specifically, banning certain keywords, which will help address a security vulnerability issue that was raised by Dependabot and our Red Team

Please and thanks in advance!

[johannesschobel]

@silentmatt can we please have a new version? ;)

[owocado]

+1

although seeing no commits activity since a year makes me wonder if the repo owner is very busy with other projects/real life.

[jorenbroekema]

Since this repository is abandoned, https://www.npmjs.com/package/expr-eval-fork I published a fork with the latest commits as 2.0.2, so you can use this to fix the prototype pollution security issue.

[Sander-Toonen]

I've created another fork a while back.

https://github.com/Pro-Fa/expr-eval
https://www.npmjs.com/package/@pro-fa/expr-eval

This fork is fully ported to typescript and adds a language server for IDE autocompletions. It also uses more modern build and testing tools and incorporates most functionality from open PRs on this project.

Note: There are a few breaking changes compared to this library, so it is not intended to be a full drop-in replacement.