[Snyk] Upgrade parse5 from 7.0.0 to 7.1.2

[Nahom1927]

Snyk has created this PR to upgrade parse5 from 7.0.0 to 7.1.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 3 versions ahead of your current version.

• The recommended version was released on 2 years ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Cross-site Request Forgery (CSRF) SNYK-JS-AXIOS-6032459	676	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-6124857	676	Proof of Concept
	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	676	Proof of Concept
	Uncontrolled resource consumption SNYK-JS-BRACES-6838727	676	Proof of Concept
	Improper Input Validation SNYK-JS-FOLLOWREDIRECTS-6141137	676	Proof of Concept
	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	676	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	676	Proof of Concept
	Denial of Service (DoS) SNYK-JS-WS-7266574	676	Proof of Concept
	Open Redirect SNYK-JS-EXPRESS-6474509	676	No Known Exploit
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	676	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	676	Proof of Concept
	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	676	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SIDEWAYFORMULA-3317169	676	No Known Exploit
	Undesired Behavior SNYK-JS-STYLEDCOMPONENTS-3149924	676	No Known Exploit
	Prototype Pollution SNYK-JS-XML2JS-5414874	676	Proof of Concept

Release notes

Package name: parse5

• 7.1.2 - 2022-11-20
  

  This release includes parse5 and parse5-parser-stream.

  • Export ERR as ErrorCodes by @ milahu in #704
  • Properly handle CR when peeking by @ fb55 in #715
  • Add CJS build of parser-stream by @ fb55 in #716

  Full Changelog: v7.1.0...v7.1.2

• 7.1.1 - 2022-09-02
• 7.1.0 - 2022-09-02
  

  This release is only for the parse5 module.

  What's Changed

  • feat(parse5): use string types for node names by @ 43081j in #631
  • fix(parser): Have </button> close <p> by @ fb55 in #534
  • docs: Fix small typo in code example by @ cheeaun in #518
  • Added coverage reporting by @ fb55 in #515
  • Improved code coverage by @ fb55 in #517 and #547

  New Contributors

  • @ cheeaun made their first contribution in #518

  Full Changelog: v7.0.0...v7.1.0

• 7.0.0 - 2022-04-20
  

  Welcome to parse5@7.0.0! ✨ This is a huge release with many changes, features and fixes.

  From an organisational perspective, the most important change is that parse5 is now maintained by a team, consisting of James (@ 43081j), Titus (@ wooorm) and me (@ fb55). We come from three projects that rely on parse5 — namely Cheerio, rehype, and Lit.

  We need your support to continue the project! If you care about parse5, please support us financially on OpenCollective.

  Headlining features of this release are ES Modules, TypeScript, and performance improvements: 7.0.0 is 45% faster than 6.0.1 with default options, and 167% faster with location information enabled (for the bench/perf benchmark, on an M1 Mac). Version 7.0.0 is a revamp of every part of the library. There are too many changes to list them all here, so here is a high-level overview:

  Breaking: ESM

  All of parse5’s packages are now ECMAScript Modules. We are providing dual packages for parse5 and parse5-htmlparser2-tree-adapter for now (see #418 and #496).

  To migrate, please read this Gist on how to update. Note that private internals are no longer available; instead, everything that you need should be imported from the main package.

  Implemented by @ 43081j in #351

  Breaking: TypeScript

  The codebase has been ported to TypeScript. This helped uncover a number of subtle logic bugs, such as dc4e269, b4b5d4a, or a0aff95. TypeScript also helps us refactor with confidence and a lot of the changes in this release would have been much harder to do without it.

  To migrate, please remove @ types/parse5* as we now ship our own types.

  Implemented by @ fb55 in #362

  Potentially breaking changes

  • parse5 was caught up with the HTML spec, and parsing results might differ in edge-cases (#442, #451)
  • The parse5-serializer-stream package was removed #481
    • To migrate, use the serialize function exported by parse5.
  • The rewriting stream now splits very long text sections (#434) and doesn’t escape text in special tags anymore (#434). If you worked around these issues before, you might have to update your code.
  • The htmlparser2 adapter now uses domhandler’s node interface (#327 by @ TrySound)
    • The format of the tree nodes has changed slightly; eg. some previous properties are now getters and setters, and vice versa.

  If you are using deep imports for any parts of the codebase, you will likely encounter some breakages:

  Show internal changes

  • The tokenizer now uses the state machine pattern from htmlparser2 5d7a780 (#362)
  • The token queue was replaced with callbacks (#404, #405, #419)
  • The OpenElementStack now uses callbacks #429
  • Mixins were removed (as part of #362)
    • Location tracking now has a substantially lower overhead #402
  • getNextToken was removed #461
  • The parser’s _bootstrap method was removed #384
  • We now drop chunks from the tokenizer right after they are emitted #432
  • The serializer is no longer a class; instead, different serializer functions call on each other #383
  • parse5 now uses the entities module for encoding and decoding entities, sharing maintenance & optimisation work with projects such as htmlparser2 (2b92054 (#362), #486)
    • entities adopted a variant of parse5’s approach of decoding entities. As a result, decoding performance is equivalent, while memory consumption is slightly lower.

  Other changes

  • minor add hooks for stack events to tree adapter interface #385
  • minor add support for fragments in parse5-parser-stream #487
  • minor add serializeOuter (like .outerHTML), scriptingEnabled option #383
  • patch fix parsing of << in comments parsed wrongly as <! (#326)
  • patch fix position of endTag for mixed-case foreign elements (#353)
  • patch fix end position of html, body (#436)
  • docs: parse5 has a new documentation website at parse5.js.org #443

  New Contributors

  Thanks @ anko, @ TrySound, @ samouri, @ alan-agius4, and @ pmdartus!

  Full Changelog: v6.0.1...v7.0.0

from parse5 GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs