Skip to content

Update flexmark to a modern version and try to avoid CVEs. #16223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
ckipp01 opened this issue Oct 20, 2022 · 2 comments · Fixed by #17347
Closed

Update flexmark to a modern version and try to avoid CVEs. #16223

ckipp01 opened this issue Oct 20, 2022 · 2 comments · Fixed by #17347
Assignees
@szymon-rd
Labels
area:doctool itype:bug
Milestone
3.3.1

Comments

@ckipp01
Copy link
Member

ckipp01 commented Oct 20, 2022 •
edited
Loading

Compiler version

All of them that contain the new Scaladoc.

Description

From what I can see since the new Scaladoc was introduced it's using a very old version of Flexmark, 0.42.12. This version was released early in 2019 and has a handful of CVEs attached to it as you can see under Vulnerabilities. Any type of CVE scanning that many places will do will pick this up. There is also a ton of extensions that are being use that are old and also have CVEs attached to them. It looks like even the newest version 0.64.0 still has some, but I feel like it's not a good idea to use something as old as this without ever updating especially seeing that there are CVEs attached to it.

Expectation

I'd expect the dependencies the compiler uses are up to date and that the team does its best to avoid dependencies with published CVEs.
@ckipp01 ckipp01 added itype:bug stat:needs triage Every issue needs to have an "area" and "itype" label labels Oct 20, 2022
@szymon-rd szymon-rd self-assigned this Oct 20, 2022
@szymon-rd szymon-rd added area:doctool and removed stat:needs triage Every issue needs to have an "area" and "itype" label labels Oct 20, 2022
@michelou
Copy link
Contributor

@ckipp01 Agreed. Related to the discussion 13799 I initiated on October 2021 (and with only 1 feedback, sadly IMO).

@ckipp01 ckipp01 mentioned this issue Feb 7, 2023
Closed
@Dedelweiss
Copy link
Contributor

Hello, I would like to help with this issue. I notice that a PR is started but blocked by an error. At least if someone has started a correction or has some suggestions, I am quite interested !

@Dedelweiss Dedelweiss mentioned this issue May 1, 2023
Merged
ckipp01 added a commit that referenced this issue May 2, 2023
@Dedelweiss @ckipp01
deps(scaladoc): update flexmark from 0.42.12 to 0.62.2 (#17347)
4d53eab 
This pr updates the flexmark dependencies used in Scaladoc from 0.42.12,
which is from 2019, up to 0.62.2. This is mainly done to tackle a bunch of CVEs that are attached to the old versions of flexmark.

fixes #16223

---------

Co-authored-by: Chris Kipp <[email protected]>
@Kordyjan Kordyjan added this to the 3.3.1 milestone Aug 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@szymon-rd szymon-rd

Labels
area:doctool itype:bug
Projects
None yet
Milestone
3.3.1
5 participants
@michelou @szymon-rd @Kordyjan @ckipp01 @Dedelweiss