Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade marked from 0.3.5 to 0.4.0 #22

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-451540
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: marked
  • 0.4.0 - 2018-05-21

    Security Fixes

    New Features

    Breaking Changes

    • Fix escaping pipes in tables (#1239)
    • Fix html output for tables to match GFM spec (#1245)
    • Fix many bugs to reach parity with CommonMark spec (#1135)
    • Fix new Renderer() so it uses default options (#1203)
    • Fix text and paragraph return types (#1248) (#1249)
    • Fix <em> less than 3 chars (#1181)
    • Fix <pre> code blocks so there is no more trailing \n (#1266)
    • Fix default langPrefix to follow CommonMark standard language- (#1265)

    CLI Changes

    • Add string argument to CLI (#1182)
    • Change CLI stdio to remove warning (#994)

    Other changes

  • 0.3.19 - 2018-03-26

    0.3.18 did not have changes to min.

  • 0.3.18 - 2018-03-22
    • Supported Markdown flavors: CommonMark 0.28 and GitHub Flavored Markdown 0.28
    • Updates to our CI pipeline; we're all green! #1098 with the caveat that there is a test that needs to get sorted (help us out #1092)
    • Start ordered lists using the initial numbers from markdown lists (#1144)
    • Added GitHub Pages site for documentation https://marked.js.org/ (#1138)
  • 0.3.17 - 2018-02-27
    • The elephant in the room: A security vulnerability was discovered and fixed. Please note, if something breaks due to these changes, it was not our intent, and please let us know by submitting a PR or issue to course correct (the nature of the zero-major release and having security as a number one priority) #1083
    • The other elephant in the room: We missed publishing a 0.3.16 release to GitHub; so, trying to make up for that a bit.
    • Updates to the project documentation and operations, you should check it out, just start with the README and you should be good.
    • New release PR template available #1076
    • Updates to default PR and Issue templates #1076
    • Lint checks + tests + continuous integration using Travis #1020
    • Updated testing output #1085 & #1087
  • 0.3.16 - 2018-02-20
  • 0.3.15 - 2018-02-19

    Fixes unintended breaking change from v0.3.14

  • 0.3.14 - 2018-02-16
    • Marked has a new home under the MarkedJS org! Other advances soon to come.
    • Updated minifier.
    • Various parser fixes
  • 0.3.13 - 2018-02-16
  • 0.3.12 - 2018-01-09
    • Addresses issue where some users might not have been able to update due to missing use strict #991
    • Parser fix #977
    • New way to perform tests with options and running individual tests #1002
    • Improved test cases
    • Improved links
  • 0.3.9 - 2017-12-23

    We think with this version we have addressed most, if not all, known security vulnerabilities. If you find more, please let us know.

  • 0.3.7 - 2017-12-01

    Should fix XSS issue discovered.

  • 0.3.6 - 2016-07-30

    v0.3.6

  • 0.3.5 - 2015-07-31
from marked GitHub release notes
Commit messages
Package name: marked The new version differs by 250 commits.
  • 78db8fb Merge pull request #1273 from 8fold/release-0.4.0
  • 30a80e2 0.4.0
  • 3957460 Merge pull request #1251 from markedjs/issue-templates
  • dd10e47 🗜️ minify [skip ci]
  • 0bc2fc5 Merge pull request #1265 from remyrylan/master
  • 0218945 Merge pull request #1266 from remyrylan/remove-extra-linebreak
  • 6ab2593 Remove extra inner linebreak from code blocks
  • 7b1d0be Update fenced code blocks to CommonMark standard
  • 4e910c3 Add a "why" to feature request
  • 0a247fe Create Proposal.md
  • 63d1a45 Change desc of feature request
  • cdd596f Update bug description
  • 0c8ff4b Remove unnecessary sections
  • 579f7bf 🗜️ minify [skip ci]
  • 42c3915 Merge pull request #1250 from tomtheisen/gfm-tasks
  • 367604e Add links to demo
  • c59e4a1 Update issue templates
  • e0434b1 Merge pull request #1253 from Martii/patch-1
  • 547ffb8 🗜️ minify [skip ci]
  • dbd0dff Merge pull request #1256 from UziTech/test-travis
  • 9b1c6aa move security scan to the end
  • b151864 fast_finish
  • 19832b4 allow redos test to fail
  • fab3ee2 Merge pull request #994 from Feder1co5oave/fixes_992

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant