module-federation.github.io
module-federation.github.io copied to clipboard
module-federation
fix(deps): update dependency prismjs to v1.27.0 [security]
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| prismjs | 1.24.1 -> 1.27.0 |
GitHub Vulnerability Alerts
CVE-2021-3801
Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.
CVE-2022-23647
Impact
Prism's Command line plugin can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code.
Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.
Patches
This bug has been fixed in v1.27.0.
Workarounds
Do not use the Command line plugin on untrusted inputs, or sanitized all code blocks (remove all HTML code text) from all code blocks that use the Command line plugin.
References
Release Notes
PrismJS/prism
v1.27.0
New components
Updated components
- AutoIt
- EditorConfig
- Ini
- MongoDB
- PureBasic
- Scala
- Systemd configuration file
Updated plugins
- Command Line
Other
v1.26.0
New components
-
Atmel AVR Assembly (#2078)
b5a70e4c -
Go module (#3209)
8476a9ab -
Keepalived Configure (#2417)
d908e457 -
Tremor & Trickle & Troy (#3087)
ec25ba65 -
Web IDL (#3107)
ef53f021
Updated components
- Use
\dfor[0-9](#3097)9fe2f93e - 6502 Assembly
- AppleScript
- AQL
- Arduino
- Avro IDL
- Bash
- Birb
- Bro
- BSL (1C:Enterprise)
- C
- C#
- Clojure
- Concurnas
- Content-Security-Policy
- Coq
- Crystal
- Cypher
- D
- Dart
- DataWeave
- EditorConfig
- Eiffel
- Elm
- ERB
- F#
- G-code
- GameMaker Language
- Go
- GraphQL
- Haml
- Haxe
- Hoon
- HTTP
- HTTP Public-Key-Pins
- HTTP Strict-Transport-Security
- Idris
- Io
- J
- Java
- Java stack trace
- JavaScript
- Jolie
- JQ
- JS stack trace
- Julia
- Keyman
- Kotlin
- Latte
- Liquid
- Lisp
- Makefile
- Markdown
- MAXScript
- Monkey
- N1QL
- nginx
- Nim
- Nix
- NSIS
- Objective-C
- OCaml
- Oz
- Pascal
- PATROL Scripting Language
- Perl
- PHP
- PHP Extras
- PL/SQL
- PowerQuery
- PowerShell
- Processing
- Prolog
- Pug
- PureBasic
- Python
- QML
- React JSX
- React TSX
- Reason
- Regex
- Ren'py
- Rip
- Ruby
- Rust
- Scheme
- Smalltalk
- Smarty
- SQL
- Squirrel
- Stan
- Structured Text (IEC 61131-3)
- Swift
- TAP
- Tremor
- Twig
- TypeScript
- URI
- V
- Verilog
- Visual Basic
- Wolfram language
- Xojo (REALbasic)
- Zig
Updated plugins
- File Highlight
- Keep Markup
- Line Highlight
- Toolbar
Updated themes
- Coy: Set
z-indexto make shadows visible in colored table cells (#3161)79f250f3 - Coy: Added padding to account for box shadow (#3143)
a6a4ce7e
Other
- Core
-
Infrastructure
- Tests: Added
.html.testfiles for replace.jslanguage tests (#3148)2e834c8c - Added regex coverage (#3138)
5333e281 - Tests: Added
TestCaseFileclass and generalizedrunTestCase(#3147)ae8888a0 - Added even more language tests (#3137)
344d0b27 - Added more plugin tests (#1969)
a394a14d - Added more language tests (#3131)
2f7f7364 -
package.json: Addedengines.nodefield (#3108)798ee4f6 - Use tabs in
package(-lock).json(#3098)8daebb4a - Update
[email protected](#3091)e6e1d5ae - Added minified CSS (#3073)
d63d6c0e
- Tests: Added
-
Website
- Readme: Clarify usage of our build system (#3239)
6f1d904a - Improved CDN usage URLs (#3285)
6c21b2f7 - Update download.html
9d5424b6 - Autoloader: Mention how to load grammars from URLs (#3218)
cefccdd1 - Added PrismJS React and HTML tutorial link (#3190)
0ecdbdce - Improved readability (#3177)
4433d7fe - Fixed red highlighting in Firefox (#3178)
746da79b - Use Keep markup to highlight code section (#3164)
ebd59e32 - Document standard tokens and provide examples (#3104)
37551200 - Fixed dead link to third-party tutorial #3155 (#3156)
31b4c1b8 - Repositioned theme selector (#3146)
ea361e5a - Adjusted TOC's line height for better readability (#3145)
c5629706 - Updated plugin header template (#3144)
faedfe85 - Update test and example pages to use Autoloader (#1936)
3d96eedc
- Readme: Clarify usage of our build system (#3239)
v1.25.0
New components
-
AviSynth (#3071)
746a4b1a -
Avro IDL (#3051)
87e5a376 -
Bicep (#3027)
c1dce998 -
GAP (CAS) (#3054)
23cd9b65 -
GN (#3062)
4f97b82b -
Hoon (#2978)
ea776756 -
Kusto (#3068)
e008ea05 -
Magma (CAS) (#3055)
a1b67ce3 -
MAXScript (#3060)
4fbdd2f8 -
Mermaid (#3050)
148c1eca -
Razor C# (#3064)
4433ccfc -
Systemd configuration file (#3053)
8df825e0 -
Wren (#3063)
6a356d25
Updated components
- Bicep
- C#
- C++
- Clojure
- Hoon
- Liquid
- Log file
- Markup
- PureScript
- Python
- Sass
- Shell session
- Swift
- TypeScript
Updated plugins
- JSONP Highlight
- Line Highlight
- Normalize Whitespace
- Previewers
Updated themes
Other
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- [ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "Published by a pub.dev verified publisher"){kind=small}
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠ Warning: custom changes will be lost.