Current version of `marked` creates npm audit issue

[joehuanguf]

npm is giving me a security issue with the current version of the marked dependency. It recommends that we upgrade to 0.7.0.

[fabb]

Related: https://github.com/storybookjs/marksy/commit/2e7f73f59d3ef9ede8a4b1888c1c05fea0d20566

[lukemarsh]

@fabb I see that marked has been downgraded but the issue has been fixed in the 0.7.0 patch

[fabb]

Yes. When marked is upgraded, the linked issue with sanitized inline elements will need fixing.

[XGHeaven]

@fabb I found that marked has been downgraded at version 8.0.0. But @storybook/addon-info still use ^7.0.0. It's also not works. 😭

[ranand]

marked is at 0.8.0 now. is it possible to upgrade marked version in package.json?

[TheresaBeckerLR]

marked is at 0.8.0 now. is it possible to upgrade marked version in package.json?

Any word on this?

[christianalfoni]

Hi there!

Version 0.8.0 breaks a lot of tests and needs to be reviewed. I have a bit too much on my plate these days, but will look at it if I get a chance! 😄

[ilias-t]

any update on this?

[patsplat]

https://github.com/storybookjs/marksy/pull/98 should patch this up. The test failures were b/c of the CI configuration.

[nikkypyra]

Could you please update the following package due to vulnerabilities: marked to 4.0.10 or greater

This will resolve the vulnerability in marked (See CVE).