Browse Source
Bumps [marked](https://github.com/markedjs/marked) from 0.3.6 to 0.3.19. **This update includes security fixes.** <details> <summary>Vulnerabilities fixed</summary> *Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/9ad1891d-443b-4ea0-b2f4-8fea2745533c).* > **[CVE-2017-1000427] marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI...** > marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser. > > Affected versions: <=0.3.6 *Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/934cfc24-3eba-4ebb-8bac-b53b7ed08c59).* > **CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')** > The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. > > Affected versions: <=0.3.6 *Sourced from The GitHub Security Advisory Database.* > **High severity vulnerability that affects marked** > The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds. > > Affected versions: <0.3.9 *Sourced from The GitHub Security Advisory Database.* > **Moderate severity vulnerability that affects marked** > A Regular expression Denial of Service (ReDoS) vulnerability in the file marked.js of the marked npm package (tested on version 0.3.7) allows a remote attacker to overload and crash a server by passing a maliciously crafted string. > > Affected versions: < 0.3.9 </details> <details> <summary>Release notes</summary> *Sourced from [marked's releases](https://github.com/markedjs/marked/releases).* > ## 0.3.18 minified required new release > 0.3.18 did not have changes to min. > > ## Minor fixes and updated docs > - Supported Markdown flavors: CommonMark 0.28 and GitHub Flavored Markdown 0.28 > - Updates to our CI pipeline; we're all green! [#1098](https://github-redirect.dependabot.com/markedjs/marked/issues/1098) with the caveat that there is a test that needs to get sorted (help us out [#1092](https://github-redirect.dependabot.com/markedjs/marked/issues/1092)) > - Start ordered lists using the initial numbers from markdown lists ([#1144](https://github-redirect.dependabot.com/markedjs/marked/issues/1144)) > - Added GitHub Pages site for documentation https://marked.js.org/ ([#1138](https://github-redirect.dependabot.com/markedjs/marked/issues/1138)) > > ## Processes and tools > - The elephant in the room: A security vulnerability was discovered and fixed. Please note, if something breaks due to these changes, it was not our intent, and please let us know by submitting a PR or issue to course correct (the nature of the zero-major release and having security as a number one priority) [#1083](https://github-redirect.dependabot.com/markedjs/marked/issues/1083) > - The other elephant in the room: We missed publishing a 0.3.16 release to GitHub; so, trying to make up for that a bit. > - Updates to the project documentation and operations, you should check it out, just start with the README and you should be good. > - New release PR template available [#1076](https://github-redirect.dependabot.com/markedjs/marked/issues/1076) > - Updates to default PR and Issue templates [#1076](https://github-redirect.dependabot.com/markedjs/marked/issues/1076) > - Lint checks + tests + continuous integration using Travis [#1020](https://github-redirect.dependabot.com/markedjs/marked/issues/1020) > - Updated testing output [#1085](https://github-redirect.dependabot.com/markedjs/marked/issues/1085) & [#1087](https://github-redirect.dependabot.com/markedjs/marked/issues/1087) > > ## Fix capturing parens > Fixes unintended breaking change from v0.3.14 > > ## New year, new home > - Marked has a new home under the MarkedJS org! Other advances soon to come. > - Updated minifier. > - Various parser fixes > > ## New Year, new Marked! > - Addresses issue where some users might not have been able to update due to missing `use strict` [#991](https://github-redirect.dependabot.com/markedjs/marked/issues/991) > - Parser fix [#977](https://github-redirect.dependabot.com/markedjs/marked/issues/977) > - New way to perform tests with options and running individual tests [#1002](https://github-redirect.dependabot.com/markedjs/marked/issues/1002) > - Improved test cases > - Improved links > > ## Merry XSSmas > We think with this version we have addressed most, if not all, known security vulnerabilities. If you find more, please let us know. > > ## XSS > Should fix XSS issue discovered. </details> <details> <summary>Commits</summary> - [`5d1baa4`](pull/148/head5d1baa4d7c) Merge pull request [#1157](https://github-redirect.dependabot.com/markedjs/marked/issues/1157) from markedjs/release-0.3.19 - [`a089991`](a089991fe3) Merge pull request [#64](https://github-redirect.dependabot.com/markedjs/marked/issues/64) from fidian/master - [`ad6c7f9`](ad6c7f9125) Merge pull request [#1156](https://github-redirect.dependabot.com/markedjs/marked/issues/1156) from UziTech/docs-navigation - [`03e015c`](03e015ca91) 0.3.19 - [`cf2def0`](cf2def076f) minify - [`29f4190`](29f4190117) Ignore DS_Store on macos - [`f29bceb`](f29bceb025) Update publishing template ([#1154](https://github-redirect.dependabot.com/markedjs/marked/issues/1154)) - [`210eed7`](210eed715b) Update badge template ([#1155](https://github-redirect.dependabot.com/markedjs/marked/issues/1155)) - [`9c01b83`](9c01b83370) link to README.md - [`fd9f444`](fd9f444133) add github ribbon - Additional commits viewable in [compare view](https://github.com/markedjs/marked/compare/v0.3.6...v0.3.19) </details> <br /> [](https://dependabot.com/compatibility-score.html?dependency-name=marked&package-manager=npm_and_yarn&previous-version=0.3.6&new-version=0.3.19) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot. </details>
dependabot[bot]
6 years ago
committed by
Ned Zimmerman
2 changed files with 2 additions and 7 deletions
Loading…
Reference in new issue