-
Notifications
You must be signed in to change notification settings - Fork 156
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): update dependency marked to v4 [security] #8037
Conversation
Deploy preview created for package Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511 |
Deploy preview created for package Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511 |
Deploy preview created for package Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511 |
Deploy preview created for package Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511 |
Deploy preview created for package Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511 |
Deploy preview created for package Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511 |
Deploy preview created for package Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511 |
f478451
to
9b120c7
Compare
d9dbf8c
to
ce48872
Compare
it looks like the react unit tests are failing because it cannot find the |
One way I can think of to get around this is to set a resolution in |
ce48872
to
727c8ad
Compare
@jeffchew I'm not sure if setting the yarn |
5342eb3
to
3c0be57
Compare
2174b51
to
e75bd11
Compare
e75bd11
to
2278c32
Compare
2278c32
to
7d44d71
Compare
snapshots should be fixed with the latest updates now, related #7935 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
This PR contains the following updates:
^2.0.0
->^4.0.0
GitHub Vulnerability Alerts
CVE-2022-21680
Impact
What kind of vulnerability is it?
Denial of service.
The regular expression
block.def
may cause catastrophic backtracking against some strings.PoC is the following.
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Patches
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
CVE-2022-21681
Impact
What kind of vulnerability is it?
Denial of service.
The regular expression
inline.reflinkSearch
may cause catastrophic backtracking against some strings.PoC is the following.
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Patches
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
Release Notes
markedjs/marked
v4.0.10
Compare Source
Bug Fixes
v4.0.9
Compare Source
Bug Fixes
v4.0.8
Compare Source
Bug Fixes
v4.0.7
Compare Source
Bug Fixes
v4.0.6
Compare Source
Bug Fixes
v4.0.5
Compare Source
Bug Fixes
v4.0.4
Compare Source
Bug Fixes
v4.0.3
Compare Source
Bug Fixes
v4.0.2
Compare Source
Bug Fixes
v4.0.1
Compare Source
Bug Fixes
main
inpackage.json
(#2276) (7e636d5)v4.0.0
Compare Source
Bug Fixes
BREAKING CHANGES
import { marked } from 'marked'
orconst { marked } = require('marked')
instead./lib/marked.js
removed. Use/marked.min.js
in script tag instead.marked.parse(...)
instead ofmarked(...)
v3.0.8
Compare Source
Bug Fixes
v3.0.7
Compare Source
Bug Fixes
v3.0.6
Compare Source
Bug Fixes
v3.0.5
Compare Source
Bug Fixes
v3.0.4
Compare Source
Bug Fixes
v3.0.3
Compare Source
Bug Fixes
v3.0.2
Compare Source
Bug Fixes
v3.0.1
Compare Source
Bug Fixes
v3.0.0
Compare Source
Bug Fixes
BREAKING CHANGES
this.lexer.inline(text, tokens)
. Theinline
function will queue the token creation until after all block tokens are created.this
object will include thelexer
as a property.this.inlineTokens
becomesthis.lexer.inline
.this
object will include theparser
as a property.this.parseInline
becomesthis.parser.parseInline
.tag
andinlineText
tokenizer function signatures have changed.nptable
tokenizer is removed and merged withtable
tokenizer.table
tokensheader
property changed to contain an array of objects for each header cell withtext
andtokens
properties.table
tokenscells
property changed torows
and is an array of rows where each row contains an array of objects for each cell withtext
andtokens
properties.v2
table
token:v3
table
token:v2.1.3
Compare Source
Bug Fixes
v2.1.2
Compare Source
Bug Fixes
engines
field (#2119) (8659353)v2.1.1
Compare Source
Bug Fixes
v2.1.0
Compare Source
Features
v2.0.7
Compare Source
Bug Fixes
v2.0.6
Compare Source
Bug Fixes
v2.0.5
Compare Source
Bug Fixes
v2.0.4
Compare Source
Bug Fixes
v2.0.3
Compare Source
Bug Fixes
type
property to thedef
token (#2002) (47e65cf)v2.0.2
Compare Source
Bug Fixes
v2.0.1
Compare Source
Bug Fixes
Configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Renovate will not automatically rebase this PR, because other commits have been found.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by WhiteSource Renovate. View repository job log here.