Update dependency marked to v0.3.18 [SECURITY] #1642
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
Deploy preview for ant-desing-vue processing. Building with commit 8347c9a https://app.netlify.com/sites/ant-desing-vue/deploys/5e00cb94eb1cd700078064e5 |
Codecov Report
@@ Coverage Diff @@
## master #1642 +/- ##
=======================================
Coverage 88.01% 88.01%
=======================================
Files 157 157
Lines 5406 5406
Branches 1522 1522
=======================================
Hits 4758 4758
Misses 579 579
Partials 69 69Continue to review full report at Codecov.
|
renovate
bot
changed the title
|
This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.3.7->0.3.18GitHub Vulnerability Alerts
CVE-2017-17461
A Regular expression Denial of Service (ReDoS) vulnerability in the file marked.js of the marked npm package (tested on version 0.3.7) allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
CVE-2017-16114
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
GHSA-8wp3-cp9v-44fm / WS-2019-0026
Versions 0.3.7 and earlier of marked unescape only lowercase while owsers support both lowercase and uppercase x in hexadecimal form of HTML character entity
GHSA-xf5p-87ch-gxw2 / WS-2019-0027
Versions 0.3.17 and earlier of marked has Four regexes were vulnerable to catastrophic backtracking. This leaves markdown servers open to a potential REDOS attack.
GHSA-wjmf-58vc-xqjr / WS-2019-0025
Versions 0.3.7 and earlier of marked When mangling is disabled via option mangle don't escape target href. This allow attacker to inject arbitrary html-event into resulting a tag.
Release Notes
markedjs/marked
v0.3.18Compare Source
v0.3.17Compare Source
v0.3.16Compare Source
v0.3.15Compare Source
Fixes unintended breaking change from v0.3.14
v0.3.14Compare Source
v0.3.13Compare Source
v0.3.12Compare Source
use strict#991v0.3.9Compare Source
We think with this version we have addressed most, if not all, known security vulnerabilities. If you find more, please let us know.
Renovate configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻️ Rebasing: Whenever PR becomes conflicted, or if you modify the PR title to begin with "
rebase!".🔕 Ignore: Close this PR and you won't be reminded about this update again.
Newsflash: Renovate has joined WhiteSource, and is now free for all use. Learn more or view updated terms and privacy policies.