hikerpig / gatsby-project-kb

Developing gatsby-theme-kb, a Gatsby theme for publishing Knowledge Base.
https://gatsby-project-kb.vercel.app/
MIT License
62 stars 15 forks source link

[Snyk] Security upgrade gatsby-plugin-mdx from 3.20.0 to 4.0.0 #60

Open hikerpig opened 1 year ago

hikerpig commented 1 year ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - packages/gatsby-theme-kb/package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **661/1000**
**Why?** Recently disclosed, Has a fix available, CVSS 7.5 | Prototype Pollution
[SNYK-JS-LOADERUTILS-3043105](https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105) | Yes | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: gatsby-plugin-mdx The new version differs by 59 commits.
  • b8eac2d chore(release): Publish
  • 3253a38 fix(gatsby-plugin-mdx): Hashing and pluginOptions (#36387) (#36395)
  • 1880491 fix(gatsby-script): Reach router import (#36385) (#36394)
  • f664ad2 feat(gatsby): Telemetry tracking for Head API (#36352)
  • ab55e4e chore: Update `got` (#36366)
  • 2b4ff76 fix(gatsby): Make runtime error overlay work in non-v8 browsers (#36365)
  • f990e08 fix(test): clear and close lmdb after each test suite (#36343)
  • 7fcf580 fix(gatsby): e.remove() is not a function when using Gatsby Head API (#36338)
  • 25fb9d1 chore: Fix pipeline tests (#36363)
  • a9132a5 chore(deps): update sharp (#35539)
  • bc80c23 chore: Add note about rehype-slug-custom-id
  • 5b6f1f6 chore(gatsby): upgrade multer (#36359)
  • f2f0acf chore(gatsby-telemetry): upgrade git-up (#36358)
  • 86a8efc chore(release): Publish next
  • 0705ac7 chore(gatsby-plugin-mdx): Update .gitignore
  • c92db36 BREAKING CHANGE(gatsby-plugin-mdx): MDX v2 (#35650)
  • 3c0dd6d chore(release): Publish next
  • 86b6ee9 Revert "chore(gatsby): Make `plugins` in `PluginOptions` type optional (#36351)"
  • a2fa5a2 chore(gatsby): Make `plugins` in `PluginOptions` type optional (#36351)
  • 6ecfe4a fix(gatsby-source-contentful): Correctly overwrite field type on Assets (#36337)
  • 0ed362c chore(docs): Pre-encoded unicode characters can't be used in paths (#36325)
  • 2bbe96d fix(deps): update dependency file-type to ^16.5.4 for gatsby-source-filesystem (#36276)
  • 2be3fa7 chore(docs): Add first batch of Cloud docs (#36218)
  • 4238142 chore(docs): Remove outdated examples and recipes (#36335)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/hikerpig/project/d4bdc70f-5197-479c-8f3c-e91d59db1706?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/hikerpig/project/d4bdc70f-5197-479c-8f3c-e91d59db1706?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"59f29c22-cf24-4c7f-af1f-d6cad267dfa4","prPublicId":"59f29c22-cf24-4c7f-af1f-d6cad267dfa4","dependencies":[{"name":"gatsby-plugin-mdx","from":"3.20.0","to":"4.0.0"}],"packageManager":"npm","projectPublicId":"d4bdc70f-5197-479c-8f3c-e91d59db1706","projectUrl":"https://app.snyk.io/org/hikerpig/project/d4bdc70f-5197-479c-8f3c-e91d59db1706?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-LOADERUTILS-3043105"],"upgrade":["SNYK-JS-LOADERUTILS-3043105"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[661]}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Prototype Pollution](https://learn.snyk.io/lessons/prototype-pollution/javascript//?loc=fix-pr)
gatsby-cloud[bot] commented 1 year ago

:x: gatsby-project-kb-master deploy preview failed

Your build failed. View the build logs.

Errors

The new node didn't pass validation: "internal.contentFilePath" is not allowed

Failing node:

{
    "id": "0fa54aa7-bfa8-5c45-8849-851d2d929efe",
    "children": [],
    "parent": "df386720-c82a-5802-9773-600dd1ed887d",
    "internal": {
        "type": "Mdx",
        "contentDigest": "b54a5f1983f3adb77e532bc57458f35a",
        "contentFilePath": "/usr/src/app/www/demo/content/readme.md",
        "owner": "gatsby-plugin-mdx"
    },
    "body": "# Gatsby knowledge base theme\n\nThis is a Gatsby theme for publishing a knowledge base or personal wiki. Named `gatsby-theme-kb`.\n\nCreate your [Second Brain](https://www.buildingasecondbrain.com/) by writing down your thoughts - or as the term used this theme `topics` -  and their relations in markdown.\n\nHeavily inspired by [gatsby-digital-garden](https://github.com/mathieudutour/gatsby-digital-garden) and [Obsidian](https://publish.obsidian.md/help/Index).\n\n## ✨ Features\n\n- Support bidirectional [[wiki-links]] in double brackets `[[]]`, will show the backlink reference context.\n- Hover preview for wiki-links.\n- A nice interactive [[graph-view]] visualizing the relationships of your notes.\n- Mobile-friendly responsive design.\n- Local search.\n- Light and dark mode.\n- Auto-generated sidebar based on notes directory.\n- Auto-generated [[table-of-contents]].\n- Configurable `mdx` processing system, with the power of `gatsby-plugin-mdx`.\n- Page customization by [[using-frontmatter]].\n\nThis demo site has some extra gatsby config apart from `gatsby-theme-kb` itself. You can [find them on github](https://github.com/hikerpig/gatsby-project-kb/blob/master/demo/gatsby-config.js).\n\n## Working with knowledge management tools\n\n### Foam\n\n[Foam](https://foambubble.github.io/foam/) is a personal knowledge management and sharing system inspired by Roam Research, built on Visual Studio Code and GitHub.\n\nBut it doesn't bundle with an official publishing system (yet).\n\nAnd `gatsby-theme-kb` is one of the few Foam publ
There was an error in your GraphQL query:

Cannot query field "childMdx" on type "File".

If you don't expect "childMdx" to exist on the type "File" it is most likely a typo.
However, if you expect "childMdx" to exist there are a couple of solutions to common problems:

- If you added a new data source and/or changed something inside gatsby-node.js/gatsby-config.js, please try a restart of your development server
- The field might be accessible in another subfield, please try your query in GraphiQL and use the GraphiQL explorer to see which fields you can query and what shape they have
- You want to optionally use your field "childMdx" and right now it is not used anywhere. Therefore Gatsby can't infer the type and add it to the GraphQL schema. A quick fix is to add at least one entry with that field ("dummy content")

It is recommended to explicitly type your GraphQL schema if you want to use optional fields. This way you don't have to add the mentioned "dummy content". Visit our docs to learn how you can define the schema for "File":
https://www.gatsbyjs.com/docs/reference/graphql-data-layer/schema-customization#creating-type-definitions