mdx-js / eslint-mdx

ESLint Parser/Plugin for MDX
https://npmjs.org/eslint-plugin-mdx
MIT License
264 stars 32 forks source link

Upgrade `remark-parse` dependency in `eslint-mdx` #370

Closed 01taylop closed 2 years ago

01taylop commented 2 years ago

Initial checklist

Affected packages and versions

1.16.0

Link to runnable example

No response

Steps to reproduce

The dependency trim has a "high severity" vulnerability being flagged in GitHub's Dependabot alerts.

The eslint-mdx package is using trim via remark-parse ^8.0.3 in packages/eslint-mdx/package.json.

Since version 9.0.0, remark-parse has not used the trim dependency (commit).

Expected behavior

Using the latest version of eslint-plugin-mdx should not cause a Dependabot alert.

Actual behavior

Using the latest version of eslint-plugin-mdx causes a Dependabot alert.

Runtime

Node v16

Package manager

npm v6

OS

macOS

Build and bundle tools

webpack

JounQin commented 2 years ago

duplicate of #312