Bump comrak from 0.7.0 to 0.17.0 in /rmark/native/rmark

[dependabot[bot]]

Bumps comrak from 0.7.0 to 0.17.0.

Release notes

Sourced from comrak's releases.

0.17.0

What's Changed

This contains some breaking changes from an API point of view, but output is largely unchanged. Spec compliance is improved, and benchmark runtime is over 20% faster.

• SECURITY: GHSA-8hqf-xjwp-p67v / Quadratic runtime when parsing Markdown (GHSL-2023-047)
  • A variety of quadratic runtime issues that could lead to DoS were reported and addressed.
  • We replaced pest with an re2c-based scanner.
• SECURITY: GHSA-xxmq-4vph-956w / Excessive output when parsing Markdown (GHSL-2023-048)
  • Reference output is limited to 100Kb.
• SECURITY: GHSA-5r3x-p7xx-x6q5 / Attacker controlled data in AST nodes is not validated (GHSL-2023-049)
  • AST nodes no longer store raw Vec<u8>s, and instead store Strings.
• Various API points were cleaned up.
• Comrak now targets Rust 2018.
• Add footnote attributes that mirror cmark-gfm by @​digitalmoksha in kivikakk/comrak#273
• Add support for full_info_string render option by @​digitalmoksha in kivikakk/comrak#276
• chore: improve debug performance by @​conradludgate in kivikakk/comrak#283

Many thanks to @​philipturnbull and @​darakian of the GitHub Security Lab for bringing these issues to my attention and detailing the reproduction steps for each case.

New Contributors

• @​digitalmoksha made their first contribution in kivikakk/comrak#273
• @​conradludgate made their first contribution in kivikakk/comrak#283

Full Changelog: https://github.com/kivikakk/comrak/compare/0.16.0...0.17.0

0.16.0

What's Changed

• Track which symbol was used to mark task item as checked by @​felipesere in kivikakk/comrak#252
• improve tagfilter performance by @​fiji-flo in kivikakk/comrak#256
• [ShortCode] Add support for gemojis via shortcodes extension by @​eklipse2k8 in kivikakk/comrak#260
• "mod three rule" fix by @​kivikakk in kivikakk/comrak#262
• Add shortcodes to the README by @​gjtorikian in kivikakk/comrak#263
• Cargo.toml: remove timebomb by @​kivikakk in kivikakk/comrak#264
• Add custom heading adapter by @​lucperkins in kivikakk/comrak#266
• Keep track of "^" symbol when within footnotes by @​gjtorikian in kivikakk/comrak#274

New Contributors

• @​felipesere made their first contribution in kivikakk/comrak#252
• @​fiji-flo made their first contribution in kivikakk/comrak#256
• @​eklipse2k8 made their first contribution in kivikakk/comrak#260
• @​lucperkins made their first contribution in kivikakk/comrak#266

Full Changelog: https://github.com/kivikakk/comrak/compare/0.15.0...0.16.0

0.15.0

What's Changed

• table: fix start_line of Table itself by @​kivikakk in kivikakk/comrak#231
• Rename header file to match c libname by @​gjtorikian in kivikakk/comrak#233

... (truncated)

Changelog

Sourced from comrak's changelog.

0.17.0

This contains some breaking changes from an API point of view, but output is largely unchanged. Spec compliance is improved, and benchmark runtime is over 20% faster.

• SECURITY: GHSA-8hqf-xjwp-p67v / Quadratic runtime when parsing Markdown (GHSL-2023-047)
  • https://github.com/kivikakk/comrak/security/advisories/GHSA-8hqf-xjwp-p67v
  • A variety of quadratic runtime issues that could lead to DoS were reported and addressed.
  • We replaced pest with an re2c-based scanner.
• SECURITY: GHSA-xxmq-4vph-956w / Excessive output when parsing Markdown (GHSL-2023-048)
  • https://github.com/kivikakk/comrak/security/advisories/GHSA-xxmq-4vph-956w
  • Reference output is limited to 100Kb.
• SECURITY: GHSA-5r3x-p7xx-x6q5 / Attacker controlled data in AST nodes is not validated (GHSL-2023-049)
  • https://github.com/kivikakk/comrak/security/advisories/GHSA-5r3x-p7xx-x6q5
  • AST nodes no longer store raw Vec<u8>s, and instead store Strings.
• Various API points were cleaned up.
• Comrak now targets Rust 2018.

Many thanks to @​philipturnbull and @​darakian of the GitHub Security Lab for bringing these issues to my attention and detailing the reproduction steps for each case.

0.16.0

• Track which symbol was used to mark task item as checked by @​felipesere in kivikakk/comrak#252
• improve tagfilter performance by @​fiji-flo in kivikakk/comrak#256
• [ShortCode] Add support for gemojis via shortcodes extension by @​eklipse2k8 in kivikakk/comrak#260
• "mod three rule" fix by @​kivikakk in kivikakk/comrak#262
• Add shortcodes to the README by @​gjtorikian in kivikakk/comrak#263
• Cargo.toml: remove timebomb by @​kivikakk in kivikakk/comrak#264
• Add custom heading adapter by @​lucperkins in kivikakk/comrak#266
• Keep track of "^" symbol when within footnotes by @​gjtorikian in kivikakk/comrak#274

0.15.0

• table: fix start_line of Table itself by @​kivikakk in kivikakk/comrak#231
• Rename header file to match c libname by @​gjtorikian in kivikakk/comrak#233
• Change the name of the ifdef by @​gjtorikian in kivikakk/comrak#234
• Add comrak_set_parse_option_smart by @​gjtorikian in kivikakk/comrak#235
• Allow c_char options to be NULL by @​gjtorikian in kivikakk/comrak#237
• Replace lazy_static dependency with once_cell by @​Turbo87 in kivikakk/comrak#238
• Make comrak --help readable on my terminal by @​mgeisler in kivikakk/comrak#242
• c-api: fix CI build by @​kivikakk in kivikakk/comrak#240
• Bump versions of some dependencies by @​helmet91 in kivikakk/comrak#243
• Adding functionality to build SyntectAdapters with custom themes, syntax sets, etc. by @​ArvinSKushwaha in kivikakk/comrak#239
• Make shell-words and xdg dependencies optional by @​silverpill in kivikakk/comrak#245
• Bump clap version to 4.0 and switch to the Derive API by @​tranzystorek-io in kivikakk/comrak#248
• c-api: remove by @​kivikakk in kivikakk/comrak#249

... (truncated)

Commits

• aad5b05 0.17.0
• 036b943 Merge pull request #286 from kivikakk/cleanups
• a8cfb1d clippy
• f489fd6 parser: tasklist with re2c
• 1935385 parser: clean up front matter parse
• 9ff5f8d Merge pull request from GHSA-5r3x-p7xx-x6q5
• 22aeda8 cargo clippy
• 50c7d1d strings: shift_buf_left on String::as_bytes_mut is unsound
• ab1cd00 scanners: remove comment; 5dff0f8 actioned it
• 1fedc64 all: nodes store strings
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.