Skip to content

Commit fa7a33c

Browse files
fix(deps): update dependency marked to v2 [security] (#7980)
[![WhiteSource Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [marked](https://marked.js.org) ([source](https://togithub.com/markedjs/marked)) | [`^1.2.9` -> `^2.0.0`](https://renovatebot.com/diffs/npm/marked/1.2.9/2.0.0) | [![age](https://badges.renovateapi.com/packages/npm/marked/2.0.0/age-slim)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://badges.renovateapi.com/packages/npm/marked/2.0.0/adoption-slim)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://badges.renovateapi.com/packages/npm/marked/2.0.0/compatibility-slim/1.2.9)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://badges.renovateapi.com/packages/npm/marked/2.0.0/confidence-slim/1.2.9)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2021-21306](https://togithub.com/markedjs/marked/security/advisories/GHSA-4r62-v4vq-hr96) ### Impact _What kind of vulnerability is it? Who is impacted?_ [Regular expression Denial of Service](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) A Denial of Service attack can affect anyone who runs user generated code through `marked`. ### Patches _Has the problem been patched? What versions should users upgrade to?_ patched in v2.0.0 ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ None. ### References _Are there any links users can visit to find out more?_ [https://github.com/markedjs/marked/issues/1927](https://togithub.com/markedjs/marked/issues/1927) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS ### For more information If you have any questions or comments about this advisory: * Open an issue in [marked](https://togithub.com/markedjs/marked/issues) --- ### Release Notes <details> <summary>markedjs/marked</summary> ### [`v2.0.0`](https://togithub.com/markedjs/marked/releases/v2.0.0) [Compare Source](https://togithub.com/markedjs/marked/compare/v1.2.9...v2.0.0) ##### Bug Fixes - Join adjacent inlineText tokens ([#&#8203;1926](https://togithub.com/markedjs/marked/issues/1926)) ([f848e77](https://togithub.com/markedjs/marked/commit/f848e7703956a6c37871432a7e128f51b1700aa0)) - Total rework of Emphasis/Strong ([#&#8203;1864](https://togithub.com/markedjs/marked/issues/1864)) ([7293251](https://togithub.com/markedjs/marked/commit/7293251c438e3ee968970f7609f1a27f9007bccd)) ##### BREAKING CHANGES - `em` and `strong` tokenizers have been merged into one `emStrong` tokenizer. - `code` and `text` tokenizers do not get passed all tokens as a second parameter. - No longer supporting IE 11. IE 11 may still work but we are not committed to making sure it works with every update. We still provide an es5 version in `lib/marked.js` but some pollyfills may be needed for IE 11 in the future. </details> --- ### Configuration 📅 **Schedule**: "" (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox. --- This PR has been generated by [WhiteSource Renovate](https://renovate.whitesourcesoftware.com). View repository job log [here](https://app.renovatebot.com/dashboard#github/carbon-design-system/carbon-for-ibm-dotcom).
1 parent c246ac3 commit fa7a33c

File tree

3 files changed

+1
-6
lines changed

3 files changed

+1
-6
lines changed

.yarn/offline-mirror/marked-1.2.9.tgz

-62.9 KB
Binary file not shown.

packages/utilities/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
"carbon-components": "10.50.0",
5454
"isomorphic-dompurify": "0.4.0",
5555
"js-cookie": "^2.2.1",
56-
"marked": "^1.2.9",
56+
"marked": "^2.0.0",
5757
"window-or-global": "^1.0.1"
5858
},
5959
"devDependencies": {

yarn.lock

-5
Original file line numberDiff line numberDiff line change
@@ -15879,11 +15879,6 @@ marked@^0.7.0:
1587915879
resolved "https://registry.yarnpkg.com/marked/-/marked-0.7.0.tgz#b64201f051d271b1edc10a04d1ae9b74bb8e5c0e"
1588015880
integrity sha512-c+yYdCZJQrsRjTPhUx7VKkApw9bwDkNbHUKo1ovgcfDjb2kc8rLuRbIFyXL5WOEUwzSSKo3IXpph2K6DqB/KZg==
1588115881

15882-
marked@^1.2.9:
15883-
version "1.2.9"
15884-
resolved "https://registry.yarnpkg.com/marked/-/marked-1.2.9.tgz#53786f8b05d4c01a2a5a76b7d1ec9943d29d72dc"
15885-
integrity sha512-H8lIX2SvyitGX+TRdtS06m1jHMijKN/XjfH6Ooii9fvxMlh8QdqBfBDkGUpMWH2kQNrtixjzYUa3SH8ROTgRRw==
15886-
1588715882
marked@^2.0.0:
1588815883
version "2.0.0"
1588915884
resolved "https://registry.yarnpkg.com/marked/-/marked-2.0.0.tgz#9662bbcb77ebbded0662a7be66ff929a8611cee5"

0 commit comments

Comments
 (0)