graphql-framework-experiment icon indicating copy to clipboard operation
graphql-framework-experiment copied to clipboard

Published 20 hours ago • verified publisher icon prisma-labs

fix(deps): update dependency prismjs to v1.21.0 [security]

Open renovate[bot] opened this issue 5 years ago • 1 comments
trafficstars

This PR contains the following updates:

Package Type Update Change
prismjs dependencies minor 1.20.0 -> 1.21.0

GitHub Vulnerability Alerts

CVE-2020-15138

Impact

The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.

This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0).

Patches

This problem is patched in v1.21.0.

Workarounds

To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

References

The vulnerability was introduced by this commit on Sep 29, 2015 and fixed by Masato Kinugawa (#​2506).

For more information

If you have any questions or comments about this advisory, please open an issue.

Release Notes

PrismJS/prism

v1.21.0

Compare Source

New components
Updated components
Updated plugins
Updated themes
  • Coy
  • Default
    • Added a comment that declares the background color of operator tokens as intentional (#​2309) 937e2691
  • Okaidia
    • Update comment text color to meet WCAG contrast recommendations to AA level (#​2292) 06495f90
Other

Renovate configuration

:date: Schedule: "" (UTC).

:vertical_traffic_light: Automerge: Disabled by config. Please merge this manually once you are satisfied.

:recycle: Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

:no_bell: Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR has been generated by WhiteSource Renovate. View repository job log here.

renovate[bot] avatar Aug 07 '20 23:08 renovate[bot]

:warning: Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

:recycle: Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you check the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: website/yarn.lock
sh: 1: Syntax error: Bad fd number
npm ERR! code ELIFECYCLE
npm ERR! errno 2
npm ERR! [email protected] preinstall: `:; (node ./preinstall.js >& /dev/null || true)`
npm ERR! Exit status 2
npm ERR! 
npm ERR! Failed at the [email protected] preinstall script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate-cache/others/npm/_logs/2020-09-28T13_26_15_866Z-debug.log
File name: yarn.lock
sh: 1: Syntax error: Bad fd number
npm ERR! code ELIFECYCLE
npm ERR! errno 2
npm ERR! [email protected] preinstall: `:; (node ./preinstall.js >& /dev/null || true)`
npm ERR! Exit status 2
npm ERR! 
npm ERR! Failed at the [email protected] preinstall script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate-cache/others/npm/_logs/2020-09-28T13_26_20_185Z-debug.log

renovate[bot] avatar Sep 28 '20 13:09 renovate[bot]