piping-draw-web
piping-draw-web copied to clipboard
[Security] Bump highlight.js from 9.15.10 to 9.18.5
Bumps highlight.js from 9.15.10 to 9.18.5. This update includes a security fix.
Vulnerabilities fixed
Sourced from The GitHub Security Advisory Database.
Prototype Pollution in highlight.js
Impact
Affected versions of this package are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable.
The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector.
If your website or application does not render user provided data it should be unaffected.
Patches
Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.
Workarounds
Patch your library
Manually patch your library to create null objects for both
languages
andaliases
:const HLJS = function(hljs) { </tr></table> ... (truncated)
Affected versions: < 9.18.2
Release notes
Sourced from highlight.js's releases.
10.3.2 - Oops, "Javascript".
Tiny tiny release, just to fix the website incorrectly not listing Javascript in the list of languages you could choose for a custom build. NPM and CDN build should not have been affected so 10.3.1 is effectively the same as 10.3.2 for those builds.
If you made a custom build from the website with 10.3 or 10.3.1 you may want to check and make sure it includes Javascript, and if not, build it again.
9.18.1 - Brrrrr, it’s freezing.
Quick release to resolve #2375
Changelog
Sourced from highlight.js's changelog.
Release v9.18.5
Version 9 has reached end-of-support and will not receive future updates or fixes.
Please see VERSION_10_UPGRADE.md and perhaps SECURITY.md.
- enh: Post-install script can be disabled with
HLJS_HIDE_UPGRADE_WARNING=yes
- fix: Deprecation notice logged at library startup a
console.log
vsconsole.warn
.
- Notice only shown if actually highlighting code, not just requiring the library.
- Node.js treats
warn
the same aserror
and that was problematic.- You (or perhaps your indirect dependency) may disable the notice with the
hideUpgradeWarningAcceptNoSupportOrSecurityUpdates
option- You can also set
HLJS_HIDE_UPGRADE_WARNING=yes
in your envionment to disable the warningExample:
hljs.configure({ hideUpgradeWarningAcceptNoSupportOrSecurityUpdates: true })
Reference: highlightjs/highlight.js#2877
Release v9.18.4
Version 9 has reached end-of-support and will not receive future updates or fixes.
Please see VERSION_10_UPGRADE.md and perhaps SECURITY.md.
Version 9.18.3
- fix(parser) Freezing issue with illegal 0 width illegals (#2524)
- backported from v10.x
Version 9.18.2
Fixes:
Commits
f54e96c
9.18.5c34318b
fix the link since i saw itd2e9bdd
include date of last releasef5e0645
typos and tweaks2e0e8ee
changelogdc45f7c
fix(livescript) fix potential catastrophic backtracking0a2624a
update readmed571b23
add warningec0bfd5
9.18.42a04835
bump v9.18.3- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase
.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
-
@dependabot rebase
will rebase this PR -
@dependabot recreate
will recreate this PR, overwriting any edits that have been made to it -
@dependabot merge
will merge this PR after your CI passes on it -
@dependabot squash and merge
will squash and merge this PR after your CI passes on it -
@dependabot cancel merge
will cancel a previously requested merge and block automerging -
@dependabot reopen
will reopen this PR if it is closed -
@dependabot close
will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually -
@dependabot ignore this major version
will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this minor version
will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this dependency
will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) -
@dependabot use these labels
will set the current labels as the default for future PRs for this repo and language -
@dependabot use these reviewers
will set the current reviewers as the default for future PRs for this repo and language -
@dependabot use these assignees
will set the current assignees as the default for future PRs for this repo and language -
@dependabot use this milestone
will set the current milestone as the default for future PRs for this repo and language -
@dependabot badge me
will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot dashboard:
- Update frequency (including time of day and day of week)
- Pull request limits (per update run and/or open at any time)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)