Bumps [marked](https://github.com/markedjs/marked) from 0.3.6 to 0.3.19. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>
*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/9ad1891d-443b-4ea0-b2f4-8fea2745533c).*
> **[CVE-2017-1000427] marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI...**
> marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
>
> Affected versions: <=0.3.6
*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/934cfc24-3eba-4ebb-8bac-b53b7ed08c59).*
> **CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')**
> The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
>
> Affected versions: <=0.3.6
*Sourced from The GitHub Security Advisory Database.*
> **High severity vulnerability that affects marked**
> The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
>
> Affected versions: <0.3.9
*Sourced from The GitHub Security Advisory Database.*
> **Moderate severity vulnerability that affects marked**
> A Regular expression Denial of Service (ReDoS) vulnerability in the file marked.js of the marked npm package (tested on version 0.3.7) allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
>
> Affected versions: < 0.3.9
</details>
<details>
<summary>Release notes</summary>
*Sourced from [marked's releases](https://github.com/markedjs/marked/releases).*
> ## 0.3.18 minified required new release
> 0.3.18 did not have changes to min.
>
> ## Minor fixes and updated docs
> - Supported Markdown flavors: CommonMark 0.28 and GitHub Flavored Markdown 0.28
> - Updates to our CI pipeline; we're all green! [#1098](https://github-redirect.dependabot.com/markedjs/marked/issues/1098) with the caveat that there is a test that needs to get sorted (help us out [#1092](https://github-redirect.dependabot.com/markedjs/marked/issues/1092))
> - Start ordered lists using the initial numbers from markdown lists ([#1144](https://github-redirect.dependabot.com/markedjs/marked/issues/1144))
> - Added GitHub Pages site for documentation https://marked.js.org/ ([#1138](https://github-redirect.dependabot.com/markedjs/marked/issues/1138))
>
> ## Processes and tools
> - The elephant in the room: A security vulnerability was discovered and fixed. Please note, if something breaks due to these changes, it was not our intent, and please let us know by submitting a PR or issue to course correct (the nature of the zero-major release and having security as a number one priority) [#1083](https://github-redirect.dependabot.com/markedjs/marked/issues/1083)
> - The other elephant in the room: We missed publishing a 0.3.16 release to GitHub; so, trying to make up for that a bit.
> - Updates to the project documentation and operations, you should check it out, just start with the README and you should be good.
> - New release PR template available [#1076](https://github-redirect.dependabot.com/markedjs/marked/issues/1076)
> - Updates to default PR and Issue templates [#1076](https://github-redirect.dependabot.com/markedjs/marked/issues/1076)
> - Lint checks + tests + continuous integration using Travis [#1020](https://github-redirect.dependabot.com/markedjs/marked/issues/1020)
> - Updated testing output [#1085](https://github-redirect.dependabot.com/markedjs/marked/issues/1085) & [#1087](https://github-redirect.dependabot.com/markedjs/marked/issues/1087)
>
> ## Fix capturing parens
> Fixes unintended breaking change from v0.3.14
>
> ## New year, new home
> - Marked has a new home under the MarkedJS org! Other advances soon to come.
> - Updated minifier.
> - Various parser fixes
>
> ## New Year, new Marked!
> - Addresses issue where some users might not have been able to update due to missing `use strict` [#991](https://github-redirect.dependabot.com/markedjs/marked/issues/991)
> - Parser fix [#977](https://github-redirect.dependabot.com/markedjs/marked/issues/977)
> - New way to perform tests with options and running individual tests [#1002](https://github-redirect.dependabot.com/markedjs/marked/issues/1002)
> - Improved test cases
> - Improved links
>
> ## Merry XSSmas
> We think with this version we have addressed most, if not all, known security vulnerabilities. If you find more, please let us know.
>
> ## XSS
> Should fix XSS issue discovered.
</details>
<details>
<summary>Commits</summary>
- [`5d1baa4`](5d1baa4d7c) Merge pull request [#1157](https://github-redirect.dependabot.com/markedjs/marked/issues/1157) from markedjs/release-0.3.19
- [`a089991`](a089991fe3) Merge pull request [#64](https://github-redirect.dependabot.com/markedjs/marked/issues/64) from fidian/master
- [`ad6c7f9`](ad6c7f9125) Merge pull request [#1156](https://github-redirect.dependabot.com/markedjs/marked/issues/1156) from UziTech/docs-navigation
- [`03e015c`](03e015ca91) 0.3.19
- [`cf2def0`](cf2def076f) minify
- [`29f4190`](29f4190117) Ignore DS_Store on macos
- [`f29bceb`](f29bceb025) Update publishing template ([#1154](https://github-redirect.dependabot.com/markedjs/marked/issues/1154))
- [`210eed7`](210eed715b) Update badge template ([#1155](https://github-redirect.dependabot.com/markedjs/marked/issues/1155))
- [`9c01b83`](9c01b83370) link to README.md
- [`fd9f444`](fd9f444133) add github ribbon
- Additional commits viewable in [compare view](https://github.com/markedjs/marked/compare/v0.3.6...v0.3.19)
</details>
<br />
[](https://dependabot.com/compatibility-score.html?dependency-name=marked&package-manager=npm_and_yarn&previous-version=0.3.6&new-version=0.3.19)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
</details>
Bumps [stringstream](https://github.com/mhart/StringStream) from 0.0.5 to 0.0.6. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>
*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/422.json).*
> **Out-of-bounds Read**
> `stringstream` allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below
>
> Affected versions: <=0.0.5
*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/422.json).*
> **Out-of-bounds Read**
> `stringstream` allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below
>
> Affected versions: <=0.0.5
</details>
<details>
<summary>Commits</summary>
- [`fee31c5`](fee31c5c4a) 0.0.6
- [`2f4a9d4`](2f4a9d496f) Merge pull request [#9](https://github-redirect.dependabot.com/mhart/StringStream/issues/9) from mhart/fix-buffer-constructor-vuln
- [`afbc744`](afbc744222) Ensure data is not a number in Buffer constructor
- See full diff in [compare view](https://github.com/mhart/StringStream/compare/v0.0.5...v0.0.6)
</details>
<br />
[](https://dependabot.com/compatibility-score.html?dependency-name=stringstream&package-manager=npm_and_yarn&previous-version=0.0.5&new-version=0.0.6)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
</details>
Bumps [superagent](https://github.com/visionmedia/superagent) from 3.6.0 to 3.8.3. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>
*Sourced from The GitHub Security Advisory Database.*
> **Low severity vulnerability that affects superagent**
> The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
>
> Affected versions: <3.7.0
*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/6b42d0b8-d68c-4f60-8815-a51f4a3efa29).*
> **CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)**
> The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
>
> Affected versions: <3.7.0
</details>
<details>
<summary>Release notes</summary>
*Sourced from [superagent's releases](https://github.com/visionmedia/superagent/releases).*
> ## v3.8.3
>
> * Add flags for 201 & 422 responses (Nikhil Fadnis)
> * Emit progress event while uploading Node `Buffer` via send method (Sergey Akhalkov)
> * Fixed setting correct cookies for redirects (Damien Clark)
> * Replace .catch with ['catch'] for IE9 Support (Miguel Stevens)
>
> ## v3.8.2
>
> * Fixed handling of exceptions thrown from callbacks
> * Stricter matching of `+json` MIME types.
>
> ## v3.8.1
>
> * Clear authorization header on cross-domain redirect
>
> ## v3.8.0
>
> * Added support for "globally" defined headers and event handlers via `superagent.agent()`. It now remembers default settings for all its requests.
> * Added optional callback to `.retry()` (Alexander Murphy)
> * Unified auth args handling in node/browser (Edmundo Alvarez)
> * Fixed error handling in zlib pipes (Kornel)
> * Documented that 3xx status codes are errors (Mickey Reiss)
>
> ## v3.7.0
>
> * Limit maximum response size. Prevents zip bombs (Kornel)
> * Catch and pass along errors in `.ok()` callback (Jeremy Ruppel)
> * Fixed parsing of XHR headers without a newline (nsf)
>
> ## v3.6.2
>
> * Upgrade MIME type dependency to a newer, secure version
> * Recognize PDF MIME as binary
> * Fix for error in subsequent require() calls (Steven de Salas)
</details>
<details>
<summary>Changelog</summary>
*Sourced from [superagent's changelog](https://github.com/visionmedia/superagent/blob/master/History.md).*
> # 3.8.3 (2018-04-29)
>
> * Add flags for 201 & 422 responses (Nikhil Fadnis)
> * Emit progress event while uploading Node `Buffer` via send method (Sergey Akhalkov)
> * Fixed setting correct cookies for redirects (Damien Clark)
> * Replace .catch with ['catch'] for IE9 Support (Miguel Stevens)
>
> # 3.8.2 (2017-12-09)
>
> * Fixed handling of exceptions thrown from callbacks
> * Stricter matching of `+json` MIME types.
>
> # 3.8.1 (2017-11-08)
>
> * Clear authorization header on cross-domain redirect
>
> # 3.8.0
>
> * Added support for "globally" defined headers and event handlers via `superagent.agent()`. It now remembers default settings for all its requests.
> * Added optional callback to `.retry()` (Alexander Murphy)
> * Unified auth args handling in node/browser (Edmundo Alvarez)
> * Fixed error handling in zlib pipes (Kornel)
> * Documented that 3xx status codes are errors (Mickey Reiss)
>
> # 3.7.0 (2017-10-17)
>
> * Limit maximum response size. Prevents zip bombs (Kornel)
> * Catch and pass along errors in `.ok()` callback (Jeremy Ruppel)
> * Fixed parsing of XHR headers without a newline (nsf)
>
> # 3.6.2 (2017-10-02)
>
> * Upgrade MIME type dependency to a newer, secure version
> * Recognize PDF MIME as binary
> * Fix for error in subsequent require() calls (Steven de Salas)
</details>
<details>
<summary>Commits</summary>
- [`295dfcd`](295dfcdace) Bump
- [`c2f65c6`](c2f65c665c) Lock marked version due to bug
- [`75d1ca0`](75d1ca0751) Fix [#1366](https://github-redirect.dependabot.com/visionmedia/superagent/issues/1366) docs
- [`bf1a87a`](bf1a87ab75) Merge pull request [#1360](https://github-redirect.dependabot.com/visionmedia/superagent/issues/1360) from itsfadnis/flags_for_201_and_422
- [`386f702`](386f7021e8) Add flags for 201 & 422 responses
- [`d70933c`](d70933ce58) Make GitHub happy
- [`b176c0e`](b176c0e953) Be super clear piping in superagent breaks everything else
- [`336b51e`](336b51e8f8) Merge pull request [#1351](https://github-redirect.dependabot.com/visionmedia/superagent/issues/1351) from jedwards1211/patch-2
- [`038bd46`](038bd464d8) file => field
- [`a6fc595`](a6fc5959c7) typo fix
- Additional commits viewable in [compare view](https://github.com/visionmedia/superagent/compare/v3.6.0...v3.8.3)
</details>
<br />
[](https://dependabot.com/compatibility-score.html?dependency-name=superagent&package-manager=npm_and_yarn&previous-version=3.6.0&new-version=3.8.3)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
</details>
dependabot[bot]