storybookjs / marksy

📑 A markdown to custom VDOM components library
MIT License
354 stars 47 forks source link

Upgrade to latest marked@4.1.0 #336

Open stvansolano opened 2 years ago

stvansolano commented 2 years ago

Fixes Inefficient Regular Expression Complexity already fixed in marked library https://github.com/advisories/GHSA-5v2h-r2cx-5xgj

marked  <=4.0.9
Severity: high
Inefficient Regular Expression Complexity in marked - https://github.com/advisories/GHSA-5v2h-r2cx-5xgj
Marked ReDoS due to email addresses being evaluated in quadratic time - https://github.com/advisories/GHSA-xf5p-87ch-gxw2
No fix available
node_modules/marksy/node_modules/marked
  marksy  *
  Depends on vulnerable versions of marked
  node_modules/marksy

CC @jimmyandrade @christianalfoni @ndelangen @hypnosphi

OleksiiFomazov commented 1 year ago

Please review this PR, can't upgrade to the latest version as they are not compatible

WindowsTerminal_OBB6r3ueSL WindowsTerminal_GQU4Zvtza7 (1)

socket-security[bot] commented 1 year ago

New dependency changes detected. Learn more about Socket for GitHub ↗︎


👍 No new dependency issues detected in pull request

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

Pull request alert summary
Issue Status
Install scripts ✅ 0 issues
Native code ✅ 0 issues
Bin script confusion ✅ 0 issues
Bin script shell injection ✅ 0 issues
Shell access ✅ 0 issues
Uses eval ✅ 0 issues
Unresolved require ✅ 0 issues
Invalid package.json ✅ 0 issues
HTTP dependency ✅ 0 issues
Git dependency ✅ 0 issues
GitHub dependency ✅ 0 issues
New author ✅ 0 issues
Potential typo squat ✅ 0 issues
Known Malware ✅ 0 issues
Telemetry ✅ 0 issues
Protestware/Troll package ✅ 0 issues

📊 Modified Dependency Overview:

⬆️ Updated Package Version Diff Added Capability Access +/- Transitive Count Publisher
marked@4.3.0 1.2.3...4.3.0 None +0/-0 tonybrix
Hypnosphi commented 1 year ago

@stvansolano please make yarn test pass