Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency marked to v4 #6

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

joshn-whitesource-app[bot]
Copy link

@joshn-whitesource-app joshn-whitesource-app bot commented Feb 7, 2024

This PR contains the following updates:

Package Type Update Change
marked (source) dependencies major 0.3.5 -> 4.0.10

By merging this PR, the issue #18 will be automatically resolved and closed:

Severity CVSS Score CVE
High High 7.5 CVE-2017-16114
High High 7.5 CVE-2022-21680
High High 7.5 CVE-2022-21681
High High 7.1 WS-2018-0031
Medium Medium 6.1 CVE-2016-10531
Medium Medium 6.1 WS-2019-0025
Medium Medium 6.1 WS-2019-0026
Medium Medium 5.9 WS-2020-0163
Medium Medium 5.3 WS-2018-0628
Medium Medium 5.3 WS-2019-0027
Low Low 3.7 CVE-2017-1000427

Release Notes

markedjs/marked (marked)

v4.0.10

Compare Source

Bug Fixes
  • security: fix redos vulnerabilities (8f80657)

v4.0.9

Compare Source

Bug Fixes

v4.0.8

Compare Source

Bug Fixes

v4.0.7

Compare Source

Bug Fixes

v4.0.6

Compare Source

Bug Fixes

v4.0.5

Compare Source

Bug Fixes

v4.0.4

Compare Source

Bug Fixes

v4.0.3

Compare Source

Bug Fixes

v4.0.2

Compare Source

Bug Fixes

v4.0.1

Compare Source

Bug Fixes

v4.0.0

Compare Source

Bug Fixes
BREAKING CHANGES
  • Default export removed. Use import { marked } from 'marked' or const { marked } = require('marked') instead.
  • /lib/marked.js removed. Use /marked.min.js in script tag instead.
  • When using marked in a script tag use marked.parse(...) instead of marked(...)

v3.0.8

Compare Source

Bug Fixes

v3.0.7

Compare Source

Bug Fixes
  • use named exports only for ESM build (#​2226)

v3.0.6

Compare Source

Bug Fixes

v3.0.5

Compare Source

Bug Fixes

v3.0.4

Compare Source

Bug Fixes

v3.0.3

Compare Source

Bug Fixes

v3.0.2

Compare Source

Bug Fixes

v3.0.1

Compare Source

Bug Fixes

v3.0.0

Compare Source

Bug Fixes
BREAKING CHANGES
  • Drop support for node 10.
  • Add module field to package.json

  • Tokenizers will create their own tokens with this.lexer.inline(text, tokens). The inline function will queue the token creation until after all block tokens are created.
  • Extensions tokenizer this object will include the lexer as a property. this.inlineTokens becomes this.lexer.inline.
  • Extensions renderer this object will include the parser as a property. this.parseInline becomes this.parser.parseInline.
  • tag and inlineText tokenizer function signatures have changed.

  • nptable tokenizer is removed and merged with table tokenizer.
  • table tokens header property changed to contain an array of objects for each header cell with text and tokens properties.
  • table tokens cells property changed to rows and is an array of rows where each row contains an array of objects for each cell with text and tokens properties.

v2 table token:

{
  "type": "table",
  "align": [null, null],
  "raw": "| a | b |\n|---|---|\n| 1 | 2 |\n",
  "header": ["a", "b"],
  "cells": [["1", "2"]],
  "tokens": {
    "header": [
      [{ "type": "text", "raw": "a", "text": "a" }],
      [{ "type": "text", "raw": "b", "text": "b" }]
    ],
    "cells": [[
      [{ "type": "text", "raw": "1", "text": "1" }],
      [{ "type": "text", "raw": "2", "text": "2" }]
    ]]
  }
}

v3 table token:

{
  "type": "table",
  "align": [null, null],
  "raw": "| a | b |\n|---|---|\n| 1 | 2 |\n",
  "header": [
    {
      "text": "a",
      "tokens": [{ "type": "text", "raw": "a", "text": "a" }]
    },
    {
      "text": "b",
      "tokens": [{ "type": "text", "raw": "b", "text": "b" }]
    }
  ],
  "rows": [
    {
      "text": "1",
      "tokens": [{ "type": "text", "raw": "1", "text": "1" }]
    },
    {
      "text": "2",
      "tokens": [{ "type": "text", "raw": "2", "text": "2" }]
    }
  ]
}

v2.1.3

Compare Source

Bug Fixes

v2.1.2

Compare Source

Bug Fixes

v2.1.1

Compare Source

Bug Fixes

v2.1.0

Compare Source

Features

v2.0.7

Compare Source

Bug Fixes

v2.0.6

Compare Source

Bug Fixes

v2.0.5

Compare Source

Bug Fixes

v2.0.4

Compare Source

Bug Fixes

v2.0.3

Compare Source

Bug Fixes

v2.0.2

Compare Source

Bug Fixes

v2.0.1

Compare Source

Bug Fixes

v2.0.0

Compare Source

Bug Fixes
BREAKING CHANGES
  • em and strong tokenizers have been merged into one emStrong tokenizer.
  • code and text tokenizers do not get passed all tokens as a second parameter.
  • No longer supporting IE 11. IE 11 may still work but we are not committed to making sure it works with every update. We still provide an es5 version in lib/marked.js but some pollyfills may be needed for IE 11 in the future.

v1.2.9

Compare Source

Bug Fixes

v1.2.8

Compare Source

Bug Fixes

v1.2.7

Compare Source

Bug Fixes

v1.2.6

Compare Source

Bug Fixes
  • fix atx heading and make regex safe (#​1853) (70ee29c)
    possible breaking change: When using the block.heading rule the text provided in capture group 2 will not be trimmed of whitespace.
  • fix link with angle brackets around href (#​1851) (656c3e4)

v1.2.5

Compare Source

Bug Fixes

v1.2.4

Compare Source

Bug Fixes

Possible Breaking Change: When using the inline.del rule the text is provided in capture group 2 instead of 1.

v1.2.3

Compare Source

Bug Fixes

v1.2.2

Compare Source

Bug Fixes

v1.2.1

Compare Source

re-release of v 1.1.2 since semantic release picked up the wrong version

v1.2.0: 1.2.0

Compare Source

Features

Fixes

Dependencies

Documentation

  • Add api dingus for babelmark #​1742
  • Update docs to use static build step and clean URLs via Vercel #​1749

v1.1.2

Compare Source

Bug Fixes

v1.1.1: 1.1.1

Compare Source

Fixes

Docs

Scripts

v1.1.0: 1.1.0

Compare Source

Features

Fixes

  • Fix renderer.code includes space at beginning of each line of code #​1645
  • Fix codespan newline #​1652
  • Fix comma after underscore emphasis #​1660
  • Fix loose task list with no tokens #​1674
  • Add browser field in package.json pointing to es5 output #​1661
  • Add newline to rendered code with language #​1670
  • Fix async highlighter walking all tokens #​1664

Docs

v1.0.0: 1.0.0

Compare Source

Breaking changes

  • Add inline tokens to marked.lexer output #​1627
  • Treat escape token same way as plain text tokens #​1642
  • Add Tokenizer to allow extending token creation #​1637

Features

  • Add marked.use() method to extend options #​1646

Fixes

  • Fix intra-word emphasis can match the wrong asterisks #​1636
  • Fix italics modifier (_) breaks links containing underscores #​1641
  • Fix closing delimited * incorrect for consecutive ocurrences #​1644

Docs

CI

v0.8.2: 0.8.2

Compare Source

Fixes

  • Add html to TextRenderer for html in headings #​1622
  • Remove html tags in heading ids #​1622

Docs

  • Update comment about GitHub breaks #​1620

v0.8.1: 0.8.1

Compare Source

Fixes

v0.8.0: 0.8.0

Compare Source

Breaking changes

Fixes

Docs

Dev Dependencies

v0.7.0: 0.7.0

Compare Source

Security

Breaking Changes

  • Deprecate sanitize and sanitizer options #​1504
  • Move fences to CommonMark #​1511
  • Move tables to GFM #​1511
  • Remove tables option #​1511
  • Single backtick in link text needs to be escaped #​1515

Fixes

Tests

  • Run tests with correct options #​1511

v0.6.3: 0.6.3

Compare Source

Fixes

Docs

DevOps

  • Use latest commit for demo master #​1457
  • Update tests to commonmark 0.29 #​1465
  • Update tests to GFM 0.29 #​1470
  • Fix commonmark spec 57 and 40 (headings) #​1475

v0.6.2: 0.6.2

Compare Source

Security

Fixes

Enhancements

  • Pass token boolean to the listitem function #​1440
  • Allow html without \n after #​1438

CLI

  • Update man page to include --test and fix argv parameters #​1442
  • Add a --version flag to print marked version #​1448

Testing

v0.6.1: 0.6.1

Compare Source

Fixes

Docs

  • Update demo site to use a worker #​1418
  • Update devDependencies to last stable #​1409
  • Update documentation about extending Renderer #​1417
  • Remove --save option as it isn't required anymore #​1422
  • Add snyk badge #​1420

v0.6.0: 0.6.0

Compare Source

Breaking Changes

  • Drop support for Node v0.10 and old browsers such as Internet Explorer
    • You should not have any problems if using Node 4+ or a modern browser
  • Add parameter slugger to Renderer.prototype.heading method #​1401
    • You should not have any problems if you do not override this method

New Features

  • Add new export marked.Slugger #​1401

Fixes

  • Fix emphasis followed by a punctuation #​1383
  • Fix bold around autolink email address #​1385
  • Make autolinks case insensitive #​1384
  • Make code fences compliant with Commonmark spec #​1387
  • Make blockquote paragraph continuation compliant with Commonmark spec #​1394
  • Make ordered list marker length compliant with Commonmark spec #​1391
  • Make empty list items compliant with Commonmark spec #​1395
  • Make tag escaping compliant with Commonmark spec #​1397
  • Make strong/bold compliant with Commonmark spec #​1400
  • Fix handling of adjacent lists #​684
  • Add better error handling when token type cannot be found #​1005
  • Fix duplicate heading id and non-latin characters #​1401

CLI

Docs

Tests

  • Remove old test covered by gfm/cm #​1389

v0.5.2: 0.5.2

Compare Source

Bug Fixes

  • Fix emphasis closing by single _ (part of left-flanking run) #​1351
  • Make URL handling consistent between links and images #​1359

Other

  • Add missing semicolons, add lint rule #​1340
  • Make Steven (@​styfle) a npm publisher #​1346
  • Fix typo in docs: responsibility #​1364
  • Add the ability to specify options on the demo page as JSON #​1357
    • Show red border when JSON options are invalid #​1360
  • Move license file back to root dir #​1356
  • Fix builds: remove node v0.10 from travis matrix #​1366
    • This does not a break compatibility in this release but it will a future release
  • Add files key to package.json to prevent publishing unused files #​1367

v0.5.1: 0.5.1

Compare Source

Security

  • Fix inline code regex and prevent REDOS #​1337
  • Use @markedjs/html-differ to prevent REDOS #​1331

Bug Fixes

  • Fix typographic substitution in (pre|code|kbd|script) blocks when smartypants=true #​1335
  • Fix auto-linking email address #​1338

Other

  • Refactor the escape() function to improve performance 10-20% #​975
  • Update copyright in source code #​1326
  • Update benchmark tests #​1019
  • Add dependency badges to readme #​1333

v0.5.0: 0.5.0

Compare Source

Security

Breaking Changes

  • Fix GFM empty table cells #​1262
  • Fix GFM extended auto-linking requiring multiple backpedals #​1293
  • Fix GFM strikethrough compatibility #​1258
  • Fix issues link references and prototypes #​1299
  • Fix hard line break when backslash at EOL #​1303
  • Fix hyperlinks with parenthesis #​1305
  • Fix loose lists #​1304
  • Fix strong and em #​1315

Docs

  • Fix typo in USING_ADVANCED.md #​1276
  • Add pictures to AUTHORS.md #​1272
  • Change badge to latest version of marked #​1300
  • Change badges from shields.io to badgen.net #​1317
  • Use iframe to sandbox generated html #​1295
  • Add additional links into readme #​1310
  • Add missing parameters for renderer methods #​1311
  • Add undocumented option descriptions #​1312
  • Add navigation sidebar to the docs #​1316

CI

  • Change travis clone depth to 3 #​1270

v0.4.0

Compare Source

Security Fixes

New Features

Breaking Changes

  • Fix escaping pipes in tables (#​1239)
  • Fix html output for tables to match GFM spec (#​1245)
  • Fix many bugs to reach parity with CommonMark spec (#​1135)
  • Fix new Renderer() so it uses default options (#​1203)
  • Fix text and paragraph return types (#​1248) (#​1249)
  • Fix <em> less than 3 chars (#​1181)
  • Fix <pre> code blocks so there is no more trailing \n (#​1266)
  • Fix default langPrefix to follow CommonMark standard language- (#​1265)

CLI Changes

  • Add string argument to CLI (#​1182)
  • Change CLI stdio to remove warning (#​994)

Other changes

v0.3.19: 0.3.18 minified required new release

Compare Source

0.3.18 did not have changes to min.

v0.3.18: Minor fixes and updated docs

Compare Source

  • Supported Markdown flavors: CommonMark 0.28 and GitHub Flavored Markdown 0.28
  • Updates to our CI pipeline; we're all green! #​1098 with the caveat that there is a test that needs to get sorted (help us out #​1092)
  • Start ordered lists using the initial numbers from markdown lists (#​1144)
  • Added GitHub Pages site for documentation https://marked.js.org/ (#​1138)

v0.3.17: Processes and tools

Compare Source

  • The elephant in the room: A security vulnerability was discovered and fixed. Please note, if something breaks due to these changes, it was not our intent, and please let us know by submitting a PR or issue to course correct (the nature of the zero-major release and having security as a number one priority) #​1083
  • The other elephant in the room: We missed publishing a 0.3.16 release to GitHub; so, trying to make up for that a bit.
  • Updates to the project documentation and operations, you should check it out, just start with the README and you should be good.
  • New release PR template available #​1076
  • Updates to default PR and Issue templates #​1076
  • Lint checks + tests + continuous integration using Travis #​1020
  • Updated testing output #​1085 & #​1087

v0.3.16

Compare Source

v0.3.15: Fix capturing parens

Compare Source

Fixes unintended breaking change from v0.3.14

v0.3.14: New year, new home

Compare Source

  • Marked has a new home under the MarkedJS org! Other advances soon to come.
  • Updated minifier.
  • Various parser fixes

v0.3.13

Compare Source

v0.3.12: New Year, new Marked!

Compare Source

  • Addresses issue where some users might not have been able to update due to missing use strict #​991
  • Parser fix #​977
  • New way to perform tests with options and running individual tests #​1002
  • Improved test cases
  • Improved links

v0.3.9: Merry XSSmas

Compare Source

We think with this version we have addressed most, if not all, known security vulnerabilities. If you find more, please let us know.

v0.3.7: XSS

Compare Source

Should fix XSS issue discovered.

v0.3.6

Compare Source


  • If you want to rebase/retry this PR, check this box

@joshn-whitesource-app joshn-whitesource-app bot added the security fix Security fix generated by Mend label Feb 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security fix Security fix generated by Mend
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants