vanilla-framework icon indicating copy to clipboard operation
vanilla-framework copied to clipboard

Update dependency mistune to v2 [SECURITY]

Open renovate[bot] opened this issue 3 years ago • 2 comments

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
mistune ==0.8.4 -> ==2.0.3 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-34749

In Mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.


Release Notes

lepture/mistune

v2.0.3

Compare Source

v2.0.2

Compare Source

Fix escape_url via https://github.com/lepture/mistune/pull/295

v2.0.1

Compare Source

Fix XSS for image link syntax.

v2.0.0

Compare Source

First release of Mistune v2.


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • [ ] If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] avatar Jul 30 '22 00:07 renovate[bot]

renovate[bot] is not a collaborator of the repo

webteam-app avatar Jul 30 '22 00:07 webteam-app

Blocked by templatefinder depending on mistune 0.8.4 (https://github.com/canonical/canonicalwebteam.templatefinder/issues/26)

bartaz avatar Aug 03 '22 11:08 bartaz