Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore(deps): update dependency marked to v4 [security] (carbon-design…
…-system#8037) [](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [marked](https://marked.js.org) ([source](https://togithub.com/markedjs/marked)) | [`^2.0.0` -> `^4.0.0`](https://renovatebot.com/diffs/npm/marked/2.0.0/4.0.10) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2022-21680](https://togithub.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf) ### Impact _What kind of vulnerability is it?_ Denial of service. The regular expression `block.def` may cause catastrophic backtracking against some strings. PoC is the following. ```javascript import * as marked from "marked"; marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`); ``` _Who is impacted?_ Anyone who runs untrusted markdown through marked and does not use a worker with a time limit. ### Patches _Has the problem been patched?_ Yes _What versions should users upgrade to?_ 4.0.10 ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources. ### References _Are there any links users can visit to find out more?_ - https://marked.js.org/using_advanced#workers - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS ### For more information If you have any questions or comments about this advisory: * Open an issue in [marked](https://togithub.com/markedjs/marked) #### [CVE-2022-21681](https://togithub.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgj) ### Impact _What kind of vulnerability is it?_ Denial of service. The regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings. PoC is the following. ```javascript import * as marked from 'marked'; console.log(marked.parse(`[x]: x \\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`)); ``` _Who is impacted?_ Anyone who runs untrusted markdown through marked and does not use a worker with a time limit. ### Patches _Has the problem been patched?_ Yes _What versions should users upgrade to?_ 4.0.10 ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources. ### References _Are there any links users can visit to find out more?_ - https://marked.js.org/using_advanced#workers - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS ### For more information If you have any questions or comments about this advisory: * Open an issue in [marked](https://togithub.com/markedjs/marked) --- ### Release Notes <details> <summary>markedjs/marked</summary> ### [`v4.0.10`](https://togithub.com/markedjs/marked/releases/v4.0.10) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.9...v4.0.10) ##### Bug Fixes - **security:** fix redos vulnerabilities ([8f80657](https://togithub.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5)) ### [`v4.0.9`](https://togithub.com/markedjs/marked/releases/v4.0.9) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.8...v4.0.9) ##### Bug Fixes - retain line breaks in tokens properly ([#&carbon-design-system#8203;2341](https://togithub.com/markedjs/marked/issues/2341)) ([a9696e2](https://togithub.com/markedjs/marked/commit/a9696e28989c0bea2077885bab1844525e18a031)) ### [`v4.0.8`](https://togithub.com/markedjs/marked/releases/v4.0.8) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.7...v4.0.8) ##### Bug Fixes - spaces on a newline after a table ([#&carbon-design-system#8203;2319](https://togithub.com/markedjs/marked/issues/2319)) ([f82ea2c](https://togithub.com/markedjs/marked/commit/f82ea2cf1be0a3ad3337bcafe1c4dd3182334bb9)) ### [`v4.0.7`](https://togithub.com/markedjs/marked/releases/v4.0.7) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.6...v4.0.7) ##### Bug Fixes - Fix every third list item broken ([#&carbon-design-system#8203;2318](https://togithub.com/markedjs/marked/issues/2318)) ([346b162](https://togithub.com/markedjs/marked/commit/346b162bb787d3b7fb1d4879c859f64155c6ca3c)), closes [#&carbon-design-system#8203;2314](https://togithub.com/markedjs/marked/issues/2314) ### [`v4.0.6`](https://togithub.com/markedjs/marked/releases/v4.0.6) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.5...v4.0.6) ##### Bug Fixes - speed up parsing long lists ([#&carbon-design-system#8203;2302](https://togithub.com/markedjs/marked/issues/2302)) ([e0005d8](https://togithub.com/markedjs/marked/commit/e0005d8232a08827f5e99b8b35b09728b2b07503)) ### [`v4.0.5`](https://togithub.com/markedjs/marked/releases/v4.0.5) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.4...v4.0.5) ##### Bug Fixes - table after paragraph without blank line ([#&carbon-design-system#8203;2298](https://togithub.com/markedjs/marked/issues/2298)) ([5714212](https://togithub.com/markedjs/marked/commit/5714212afd4a9ee0864fff70bad034f7c0842a3c)) ### [`v4.0.4`](https://togithub.com/markedjs/marked/releases/v4.0.4) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.3...v4.0.4) ##### Bug Fixes - fix cli ([#&carbon-design-system#8203;2294](https://togithub.com/markedjs/marked/issues/2294)) ([ab2977a](https://togithub.com/markedjs/marked/commit/ab2977a3363230df51ccbb2b3f8bf46389c50283)) ### [`v4.0.3`](https://togithub.com/markedjs/marked/releases/v4.0.3) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.2...v4.0.3) ##### Bug Fixes - build min from umd ([#&carbon-design-system#8203;2283](https://togithub.com/markedjs/marked/issues/2283)) ([ea26ea9](https://togithub.com/markedjs/marked/commit/ea26ea9bdf7aad4e4c645f85e8e816e80a2be6c2)) ### [`v4.0.2`](https://togithub.com/markedjs/marked/releases/v4.0.2) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.1...v4.0.2) ##### Bug Fixes - Create separate CJS and UMD builds ([#&carbon-design-system#8203;2281](https://togithub.com/markedjs/marked/issues/2281)) ([62faaf4](https://togithub.com/markedjs/marked/commit/62faaf4c912151dfe361d0459d5e89a439c38fd4)) ### [`v4.0.1`](https://togithub.com/markedjs/marked/releases/v4.0.1) [Compare Source](https://togithub.com/markedjs/marked/compare/v4.0.0...v4.0.1) ##### Bug Fixes - Set commonJS code as `main` in `package.json` ([#&carbon-design-system#8203;2276](https://togithub.com/markedjs/marked/issues/2276)) ([7e636d5](https://togithub.com/markedjs/marked/commit/7e636d5a0b04b43f2b67a2abb2b8ae35a5122a42)) ### [`v4.0.0`](https://togithub.com/markedjs/marked/releases/v4.0.0) [Compare Source](https://togithub.com/markedjs/marked/compare/v3.0.8...v4.0.0) ##### Bug Fixes - Convert to ESM ([#&carbon-design-system#8203;2227](https://togithub.com/markedjs/marked/issues/2227)) ([4afb228](https://togithub.com/markedjs/marked/commit/4afb228d956a415624c4e5554bb8f25d047676fe)) ##### BREAKING CHANGES - Default export removed. Use `import { marked } from 'marked'` or `const { marked } = require('marked')` instead. - `/lib/marked.js` removed. Use `/marked.min.js` in script tag instead. - When using marked in a script tag use `marked.parse(...)` instead of `marked(...)` ### [`v3.0.8`](https://togithub.com/markedjs/marked/releases/v3.0.8) [Compare Source](https://togithub.com/markedjs/marked/compare/v3.0.7...v3.0.8) ##### Bug Fixes - walkTokens uses marked as this ([#&carbon-design-system#8203;2251](https://togithub.com/markedjs/marked/issues/2251)) ([2da5885](https://togithub.com/markedjs/marked/commit/2da588598992065d7bf54a740d2011f8326d46cd)) ### [`v3.0.7`](https://togithub.com/markedjs/marked/releases/v3.0.7) [Compare Source](https://togithub.com/markedjs/marked/compare/v3.0.6...v3.0.7) ##### Bug Fixes - use named exports only for ESM build ([#&carbon-design-system#8203;2226](https://togithub.com/markedjs/marked/pull/2226)) ### [`v3.0.6`](https://togithub.com/markedjs/marked/releases/v3.0.6) [Compare Source](https://togithub.com/markedjs/marked/compare/v3.0.5...v3.0.6) ##### Bug Fixes - Remove esm interop ([#&carbon-design-system#8203;2225](https://togithub.com/markedjs/marked/issues/2225)) ([4bc9121](https://togithub.com/markedjs/marked/commit/4bc91215a07df5644c581925a70beda95703f693)) ### [`v3.0.5`](https://togithub.com/markedjs/marked/releases/v3.0.5) [Compare Source](https://togithub.com/markedjs/marked/compare/v3.0.4...v3.0.5) ##### Bug Fixes - Expose named exports for ESM build ([#&carbon-design-system#8203;2223](https://togithub.com/markedjs/marked/issues/2223)) ([3959651](https://togithub.com/markedjs/marked/commit/39596513544112b628921efe95b8b3fb04ab38e7)) ### [`v3.0.4`](https://togithub.com/markedjs/marked/releases/v3.0.4) [Compare Source](https://togithub.com/markedjs/marked/compare/v3.0.3...v3.0.4) ##### Bug Fixes - fix detection of orphaned emStrong delimiters ([#&carbon-design-system#8203;2203](https://togithub.com/markedjs/marked/issues/2203)) ([7792adc](https://togithub.com/markedjs/marked/commit/7792adcfe694ea442c6a4e794ac161c27d4fc89a)) ### [`v3.0.3`](https://togithub.com/markedjs/marked/releases/v3.0.3) [Compare Source](https://togithub.com/markedjs/marked/compare/v3.0.2...v3.0.3) ##### Bug Fixes - fix space at end of table line ([#&carbon-design-system#8203;2201](https://togithub.com/markedjs/marked/issues/2201)) ([910f0f0](https://togithub.com/markedjs/marked/commit/910f0f035617f7e2dd7e4f7a08c3d01d73c7f453)) ### [`v3.0.2`](https://togithub.com/markedjs/marked/releases/v3.0.2) [Compare Source](https://togithub.com/markedjs/marked/compare/v3.0.1...v3.0.2) ##### Bug Fixes - stop table at lines with only whitespace ([#&carbon-design-system#8203;2188](https://togithub.com/markedjs/marked/issues/2188)) ([21268ab](https://togithub.com/markedjs/marked/commit/21268abfba4359772daa83adcaac8e053cba8657)) ### [`v3.0.1`](https://togithub.com/markedjs/marked/releases/v3.0.1) [Compare Source](https://togithub.com/markedjs/marked/compare/v3.0.0...v3.0.1) ##### Bug Fixes - fix gfm urls after link ([#&carbon-design-system#8203;2186](https://togithub.com/markedjs/marked/issues/2186)) ([e03b5c1](https://togithub.com/markedjs/marked/commit/e03b5c1f8d87b0875ff644d15f6ac16489c7a1cf)) ### [`v3.0.0`](https://togithub.com/markedjs/marked/releases/v3.0.0) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.1.3...v3.0.0) ##### Bug Fixes - Tokenizers lex their own child tokens ([#&carbon-design-system#8203;2124](https://togithub.com/markedjs/marked/issues/2124)) ([288f1cb](https://togithub.com/markedjs/marked/commit/288f1cbe2f55881972c0f594ddb9910888986bee)) - Add module field to package.json ([#&carbon-design-system#8203;2143](https://togithub.com/markedjs/marked/issues/2143)) ([edc2e6d](https://togithub.com/markedjs/marked/commit/edc2e6dc129364b127c8a41dc6a83dd88daffba4)) - Drop node 10 support ([#&carbon-design-system#8203;2157](https://togithub.com/markedjs/marked/issues/2157)) ([433b16f](https://togithub.com/markedjs/marked/commit/433b16fa3ac8ddcaead519b7f4e284137f7fac03)) - Full Commonmark compliance for Lists ([#&carbon-design-system#8203;2112](https://togithub.com/markedjs/marked/issues/2112)) ([eb33d3b](https://togithub.com/markedjs/marked/commit/eb33d3b3a9f735ee9bee251d26bf779880dc3114)) - Refactor table tokens ([#&carbon-design-system#8203;2166](https://togithub.com/markedjs/marked/issues/2166)) ([bc400ac](https://togithub.com/markedjs/marked/commit/bc400ac789c76e915df82b0998d3fd12c89da2e8)) ##### BREAKING CHANGES - Drop support for node 10. - Add module field to package.json *** - Tokenizers will create their own tokens with `this.lexer.inline(text, tokens)`. The `inline` function will queue the token creation until after all block tokens are created. - Extensions tokenizer `this` object will include the `lexer` as a property. `this.inlineTokens` becomes `this.lexer.inline`. - Extensions renderer `this` object will include the `parser` as a property. `this.parseInline` becomes `this.parser.parseInline`. - `tag` and `inlineText` tokenizer function signatures have changed. *** - `nptable` tokenizer is removed and merged with `table` tokenizer. - `table` tokens `header` property changed to contain an array of objects for each header cell with `text` and `tokens` properties. - `table` tokens `cells` property changed to `rows` and is an array of rows where each row contains an array of objects for each cell with `text` and `tokens` properties. v2 `table` token: ```json { "type": "table", "align": [null, null], "raw": "| a | b |\n|---|---|\n| 1 | 2 |\n", "header": ["a", "b"], "cells": [["1", "2"]], "tokens": { "header": [ [{ "type": "text", "raw": "a", "text": "a" }], [{ "type": "text", "raw": "b", "text": "b" }] ], "cells": [[ [{ "type": "text", "raw": "1", "text": "1" }], [{ "type": "text", "raw": "2", "text": "2" }] ]] } } ``` v3 `table` token: ```json { "type": "table", "align": [null, null], "raw": "| a | b |\n|---|---|\n| 1 | 2 |\n", "header": [ { "text": "a", "tokens": [{ "type": "text", "raw": "a", "text": "a" }] }, { "text": "b", "tokens": [{ "type": "text", "raw": "b", "text": "b" }] } ], "rows": [ { "text": "1", "tokens": [{ "type": "text", "raw": "1", "text": "1" }] }, { "text": "2", "tokens": [{ "type": "text", "raw": "2", "text": "2" }] } ] } ``` ### [`v2.1.3`](https://togithub.com/markedjs/marked/releases/v2.1.3) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.1.2...v2.1.3) ##### Bug Fixes - update commonmark spec to v0.30 ([#&carbon-design-system#8203;2113](https://togithub.com/markedjs/marked/issues/2113)) ([62d6a0e](https://togithub.com/markedjs/marked/commit/62d6a0e3257f9e8a710300e71a09ab01263b4731)) ### [`v2.1.2`](https://togithub.com/markedjs/marked/releases/v2.1.2) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.1.1...v2.1.2) ##### Bug Fixes - add Node.js 10 to CI and loosen `engines` field ([#&carbon-design-system#8203;2119](https://togithub.com/markedjs/marked/issues/2119)) ([8659353](https://togithub.com/markedjs/marked/commit/8659353bcb998e751a90306344acf7d69e26874c)) ### [`v2.1.1`](https://togithub.com/markedjs/marked/releases/v2.1.1) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.1.0...v2.1.1) ##### Bug Fixes - fix node v12 ([#&carbon-design-system#8203;2109](https://togithub.com/markedjs/marked/issues/2109)) ([af14068](https://togithub.com/markedjs/marked/commit/af14068b99618242c9dee6147ea3432f7903322e)) ### [`v2.1.0`](https://togithub.com/markedjs/marked/releases/v2.1.0) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.0.7...v2.1.0) ##### Features - Custom Tokenizer/Renderer extensions ([#&carbon-design-system#8203;2043](https://togithub.com/markedjs/marked/issues/2043)) ([5be9d6d](https://togithub.com/markedjs/marked/commit/5be9d6d70ea35be6398ee35958fb8ac955a89fbe)) ### [`v2.0.7`](https://togithub.com/markedjs/marked/releases/v2.0.7) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.0.6...v2.0.7) ##### Bug Fixes - em strong ([#&carbon-design-system#8203;2075](https://togithub.com/markedjs/marked/issues/2075)) ([825a9f8](https://togithub.com/markedjs/marked/commit/825a9f82af05448d85618bbac6ade8fbf9df286b)) ### [`v2.0.6`](https://togithub.com/markedjs/marked/releases/v2.0.6) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.0.5...v2.0.6) ##### Bug Fixes - fix autolink email after single space ([#&carbon-design-system#8203;2073](https://togithub.com/markedjs/marked/issues/2073)) ([6c9a899](https://togithub.com/markedjs/marked/commit/6c9a8999ddb8ca9c975120ac323cdad9a421db97)) ### [`v2.0.5`](https://togithub.com/markedjs/marked/releases/v2.0.5) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.0.4...v2.0.5) ##### Bug Fixes - call walkTokens when calling marked with a callback([#&carbon-design-system#8203;2060](https://togithub.com/markedjs/marked/issues/2060)) ([1d97308](https://togithub.com/markedjs/marked/commit/1d973084abda13ee0143f2d3a1812733f0666488)) ### [`v2.0.4`](https://togithub.com/markedjs/marked/releases/v2.0.4) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.0.3...v2.0.4) ##### Bug Fixes - Fix indented markdown in html ([#&carbon-design-system#8203;2052](https://togithub.com/markedjs/marked/issues/2052)) ([6435ac9](https://togithub.com/markedjs/marked/commit/6435ac98896212b4f117b024cccd4c7e186a8b21)) ### [`v2.0.3`](https://togithub.com/markedjs/marked/releases/v2.0.3) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.0.2...v2.0.3) ##### Bug Fixes - actually add a `type` property to the `def` token ([#&carbon-design-system#8203;2002](https://togithub.com/markedjs/marked/issues/2002)) ([47e65cf](https://togithub.com/markedjs/marked/commit/47e65cfb63e8ea8acceb676f59d8d37d346ebcaf)) ### [`v2.0.2`](https://togithub.com/markedjs/marked/releases/v2.0.2) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.0.1...v2.0.2) ##### Bug Fixes - add type property on def token ([#&carbon-design-system#8203;2001](https://togithub.com/markedjs/marked/issues/2001)) ([009427f](https://togithub.com/markedjs/marked/commit/009427f65dadd5dff9ec0189e008677aea9fbcfa)) ### [`v2.0.1`](https://togithub.com/markedjs/marked/releases/v2.0.1) [Compare Source](https://togithub.com/markedjs/marked/compare/v2.0.0...v2.0.1) ##### Bug Fixes - fix items between lists ([#&carbon-design-system#8203;1936](https://togithub.com/markedjs/marked/issues/1936)) ([46cdfc1](https://togithub.com/markedjs/marked/commit/46cdfc1ecec44660afc9040cb76de276a0ad7d5f)) </details> --- ### Configuration 📅 **Schedule**: "" (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Renovate will not automatically rebase this PR, because other commits have been found. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox. --- This PR has been generated by [WhiteSource Renovate](https://renovate.whitesourcesoftware.com). View repository job log [here](https://app.renovatebot.com/dashboard#github/carbon-design-system/carbon-for-ibm-dotcom).
](https://renovatebot.com){kind=link}
- Loading branch information
1 parent
e7a3b1a
commit 3f7bf20