Inefficient Regular Expression Complexity in marked

[frankl7800]

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Inefficient Regular Expression Complexity in marked          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ marked                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.0.10                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @frctl/fractal                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @frctl/fractal > @frctl/core > marked                        │
│               │ @frctl/fractal > @frctl/handlebars > @frctl/core > marked    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1006883                     │
│               │ https://www.npmjs.com/advisories/1006884                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

[mihkeleidast]

Closing because the issue template has been ignored without reason.

Note that:

• There is already a pr open to update (#1129) and there are comments explaining why we cannot at this point.
• Without a reasonable explanation why this is an actual security concern, the reasoning will not change. Fractal passes to marked only your own content, which should not be "untrusted", so the security advisory should not apply.