graphql.github.io
graphql.github.io copied to clipboard
Update dependency prismjs to v1.27.0 [SECURITY]
This PR contains the following updates:
Package | Change | Age | Adoption | Passing | Confidence |
---|---|---|---|---|---|
prismjs | 1.25.0 -> 1.27.0 |
GitHub Vulnerability Alerts
CVE-2022-23647
Impact
Prism's Command line plugin can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code.
Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.
Patches
This bug has been fixed in v1.27.0.
Workarounds
Do not use the Command line plugin on untrusted inputs, or sanitized all code blocks (remove all HTML code text) from all code blocks that use the Command line plugin.
References
Release Notes
PrismJS/prism
v1.27.0
New components
Updated components
- AutoIt
- EditorConfig
- Ini
- MongoDB
- PureBasic
- Scala
- Systemd configuration file
Updated plugins
- Command Line
Other
v1.26.0
New components
-
Atmel AVR Assembly (#2078)
b5a70e4c
-
Go module (#3209)
8476a9ab
-
Keepalived Configure (#2417)
d908e457
-
Tremor & Trickle & Troy (#3087)
ec25ba65
-
Web IDL (#3107)
ef53f021
Updated components
- Use
\d
for[0-9]
(#3097)9fe2f93e
- 6502 Assembly
- AppleScript
- AQL
- Arduino
- Avro IDL
- Bash
- Birb
- Bro
- BSL (1C:Enterprise)
- C
- C#
- Clojure
- Concurnas
- Content-Security-Policy
- Coq
- Crystal
- Cypher
- D
- Dart
- DataWeave
- EditorConfig
- Eiffel
- Elm
- ERB
- F#
- G-code
- GameMaker Language
- Go
- GraphQL
- Haml
- Haxe
- Hoon
- HTTP
- HTTP Public-Key-Pins
- HTTP Strict-Transport-Security
- Idris
- Io
- J
- Java
- Java stack trace
- JavaScript
- Jolie
- JQ
- JS stack trace
- Julia
- Keyman
- Kotlin
- Latte
- Liquid
- Lisp
- Makefile
- Markdown
- MAXScript
- Monkey
- N1QL
- nginx
- Nim
- Nix
- NSIS
- Objective-C
- OCaml
- Oz
- Pascal
- PATROL Scripting Language
- Perl
- PHP
- PHP Extras
- PL/SQL
- PowerQuery
- PowerShell
- Processing
- Prolog
- Pug
- PureBasic
- Python
- QML
- React JSX
- React TSX
- Reason
- Regex
- Ren'py
- Rip
- Ruby
- Rust
- Scheme
- Smalltalk
- Smarty
- SQL
- Squirrel
- Stan
- Structured Text (IEC 61131-3)
- Swift
- TAP
- Tremor
- Twig
- TypeScript
- URI
- V
- Verilog
- Visual Basic
- Wolfram language
- Xojo (REALbasic)
- Zig
Updated plugins
- File Highlight
- Keep Markup
- Line Highlight
- Toolbar
Updated themes
- Coy: Set
z-index
to make shadows visible in colored table cells (#3161)79f250f3
- Coy: Added padding to account for box shadow (#3143)
a6a4ce7e
Other
- Core
-
Infrastructure
- Tests: Added
.html.test
files for replace.js
language tests (#3148)2e834c8c
- Added regex coverage (#3138)
5333e281
- Tests: Added
TestCaseFile
class and generalizedrunTestCase
(#3147)ae8888a0
- Added even more language tests (#3137)
344d0b27
- Added more plugin tests (#1969)
a394a14d
- Added more language tests (#3131)
2f7f7364
-
package.json
: Addedengines.node
field (#3108)798ee4f6
- Use tabs in
package(-lock).json
(#3098)8daebb4a
- Update
[email protected]
(#3091)e6e1d5ae
- Added minified CSS (#3073)
d63d6c0e
- Tests: Added
-
Website
- Readme: Clarify usage of our build system (#3239)
6f1d904a
- Improved CDN usage URLs (#3285)
6c21b2f7
- Update download.html
9d5424b6
- Autoloader: Mention how to load grammars from URLs (#3218)
cefccdd1
- Added PrismJS React and HTML tutorial link (#3190)
0ecdbdce
- Improved readability (#3177)
4433d7fe
- Fixed red highlighting in Firefox (#3178)
746da79b
- Use Keep markup to highlight code section (#3164)
ebd59e32
- Document standard tokens and provide examples (#3104)
37551200
- Fixed dead link to third-party tutorial #3155 (#3156)
31b4c1b8
- Repositioned theme selector (#3146)
ea361e5a
- Adjusted TOC's line height for better readability (#3145)
c5629706
- Updated plugin header template (#3144)
faedfe85
- Update test and example pages to use Autoloader (#1936)
3d96eedc
- Readme: Clarify usage of our build system (#3239)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- [ ] If you want to rebase/retry this PR, click this checkbox.
This PR has been generated by Mend Renovate. View repository job log here.