search

elliottsj / combine-loader

Webpack loader to combine results from multiple loaders into one object
MIT License
8 stars 0 forks source link

Update dependency markdown-it to v12.3.2 [SECURITY] - autoclosed #221

Closed renovate[bot] closed 1 year ago

renovate[bot] commented 2 years ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
markdown-it 12.0.4 -> 12.3.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-21670

Impact

Special patterns with length > 50K chars can slow down parser significantly.

const md = require('markdown-it')();

md.render(`x ${' '.repeat(150000)} x  \nx`);

Patches

Upgrade to v12.3.2+

Workarounds

No.

References

Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101

Release Notes

markdown-it/markdown-it ### [`v12.3.2`](https://togithub.com/markdown-it/markdown-it/blob/HEAD/CHANGELOG.md#​1232---2022-01-08) [Compare Source](https://togithub.com/markdown-it/markdown-it/compare/12.3.1...12.3.2) ##### Security - Fix possible ReDOS in newline rule. Thanks to [@​MakeNowJust](https://togithub.com/MakeNowJust). ### [`v12.3.1`](https://togithub.com/markdown-it/markdown-it/blob/HEAD/CHANGELOG.md#​1231---2022-01-07) [Compare Source](https://togithub.com/markdown-it/markdown-it/compare/12.3.0...12.3.1) ##### Fixed - Fix corner case when tab prevents paragraph continuation in lists, [#​830](https://togithub.com/markdown-it/markdown-it/issues/830). ### [`v12.3.0`](https://togithub.com/markdown-it/markdown-it/blob/HEAD/CHANGELOG.md#​1230---2021-12-09) [Compare Source](https://togithub.com/markdown-it/markdown-it/compare/12.2.0...12.3.0) ##### Changed - `StateInline.delimiters[].jump` is removed. ##### Fixed - Fixed quadratic complexity in pathological `***<10k stars>***a***<10k stars>***` case. ### [`v12.2.0`](https://togithub.com/markdown-it/markdown-it/blob/HEAD/CHANGELOG.md#​1220---2021-08-02) [Compare Source](https://togithub.com/markdown-it/markdown-it/compare/12.1.0...12.2.0) ##### Added - Ordered lists: add order value to token info. ##### Fixed - Always suffix indented code block with a newline, [#​799](https://togithub.com/markdown-it/markdown-it/issues/799). ### [`v12.1.0`](https://togithub.com/markdown-it/markdown-it/blob/HEAD/CHANGELOG.md#​1210---2021-07-01) [Compare Source](https://togithub.com/markdown-it/markdown-it/compare/12.0.6...12.1.0) ##### Changed - Updated CM spec compatibility to 0.30. ### [`v12.0.6`](https://togithub.com/markdown-it/markdown-it/blob/HEAD/CHANGELOG.md#​1206---2021-04-16) [Compare Source](https://togithub.com/markdown-it/markdown-it/compare/12.0.5...12.0.6) ##### Fixed - Newline in `alt` should be rendered, [#​775](https://togithub.com/markdown-it/markdown-it/issues/775). ### [`v12.0.5`](https://togithub.com/markdown-it/markdown-it/blob/HEAD/CHANGELOG.md#​1205---2021-04-15) [Compare Source](https://togithub.com/markdown-it/markdown-it/compare/12.0.4...12.0.5) ##### Fixed - HTML block tags with `===` inside are no longer incorrectly interpreted as headers, [#​772](https://togithub.com/markdown-it/markdown-it/issues/772). - Fix table/list parsing ambiguity, [#​767](https://togithub.com/markdown-it/markdown-it/issues/767).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.