search

tcort / markdown-link-extractor

extracts links from markdown texts
ISC License
23 stars 20 forks source link

Update to marked > 0.6.2 for vulnerability #5

Closed rajsite closed 5 years ago

rajsite commented 5 years ago

There was a vulnerability reported in the version of marked this package relies on here: https://www.npmjs.com/advisories/812

Would it be possible to bump the marked dependency to a version that does not have this advisory notice?

tcort commented 5 years ago

The pull request has been merged and a new version has been published... 1.2.1

Chaphasilor commented 3 years ago

There's a new one: https://npmjs.com/advisories/1623

Looking at the changelog for marked@2.0.0, it seems like a version bump is all that's needed

@tcort what do you think? version bump and be done with it? :)