fix(FormidableLabs#1281): Upgrade unified and ecosystem to resolve se…

…curity vulnerability
doug-wade · Feb 11, 2024 · 85659d3 · 85659d3
1 parent ab625ba
commit 85659d3
Show file tree

Hide file tree

Showing 4 changed files with 667 additions and 81 deletions.
diff --git a/examples/one-page/index.html b/examples/one-page/index.html
@@ -33,13 +33,13 @@
           "react-syntax-highlighter": "https://esm.sh/v121/react-syntax-highlighter@^15.5.0?deps=react@18.2.0",
           "react-syntax-highlighter/dist/cjs/styles/prism/vs-dark.js": "https://esm.sh/v121/react-syntax-highlighter@^15.5.0/dist/esm/styles/prism/vs-dark.js?deps=react@18.2.0",
           "react-syntax-highlighter/dist/cjs/styles/prism/index.js": "https://esm.sh/v121/react-syntax-highlighter@^15.5.0/dist/esm/styles/prism/index.js?deps=react@18.2.0",
-          "rehype-raw": "https://esm.sh/v121/rehype-raw@^5.1.0?deps=react@18.2.0",
-          "rehype-react": "https://esm.sh/v121/rehype-react@^6.0.0?deps=react@18.2.0",
-          "remark-parse": "https://esm.sh/v121/remark-parse@^8.0.3?deps=react@18.2.0",
-          "remark-rehype": "https://esm.sh/v121/remark-rehype@^7.0.0?deps=react@18.2.0",
+          "rehype-raw": "https://esm.sh/v121/rehype-raw@^7.0.0?deps=react@18.2.0",
+          "rehype-react": "https://esm.sh/v121/rehype-react@^8.0.0?deps=react@18.2.0",
+          "remark-parse": "https://esm.sh/v121/remark-parse@^11.0.0?deps=react@18.2.0",
+          "remark-rehype": "https://esm.sh/v121/remark-rehype@^11.1.0?deps=react@18.2.0",
           "styled-components": "https://esm.sh/v121/styled-components@^5.3.6?deps=react@18.2.0",
           "styled-system": "https://esm.sh/v121/styled-system@5.1.5?deps=react@18.2.0",
-          "unified": "https://esm.sh/v121/unified@^9.0.0?deps=react@18.2.0",
+          "unified": "https://esm.sh/v121/unified@^11.0.4?deps=react@18.2.0",
           "unist-util-visit": "https://esm.sh/v121/unist-util-visit@^2.0.3?deps=react@18.2.0",
           "use-resize-observer": "https://esm.sh/v121/use-resize-observer@^9.0.2?deps=react@18.2.0"
         }

diff --git a/packages/spectacle/package.json b/packages/spectacle/package.json
@@ -30,13 +30,13 @@
     "react-spring": "^9.5.5",
     "react-swipeable": "^7.0.0",
     "react-syntax-highlighter": "^15.5.0",
-    "rehype-raw": "^5.1.0",
-    "rehype-react": "^6.0.0",
-    "remark-parse": "^8.0.3",
-    "remark-rehype": "^7.0.0",
+    "rehype-raw": "^7.0.0",
+    "rehype-react": "^8.0.0",
+    "remark-parse": "^11.0.0",
+    "remark-rehype": "^11.1.0",
     "styled-components": "^5.3.6",
     "styled-system": "5.1.5",
-    "unified": "^9.0.0",
+    "unified": "^11.0.4",
     "unist-util-visit": "^2.0.3",
     "use-resize-observer": "^9.0.2"
   },

diff --git a/packages/spectacle/src/components/markdown/markdown.tsx b/packages/spectacle/src/components/markdown/markdown.tsx
@@ -2,7 +2,7 @@
 import { DeckContext } from '../deck/deck';
 import presenterNotesPlugin from '../../utils/remark-rehype-presenter-notes';
 import CodePane, { CodePaneProps } from '../code-pane';
-import unified from 'unified';
+import { unified } from 'unified';
 import styled from 'styled-components';
 import { compose, layout, position } from 'styled-system';
 import remark from 'remark-parse';
@@ -37,6 +37,7 @@ import {
   directiveParserPlugin,
   directivesHandlerPlugin
 } from '../../utils/remark-rehype-directive';
+import * as production from 'react/jsx-runtime';
 
 type MarkdownProps = CommonMarkdownProps & MapAndTemplate;
 const Container = styled('div')(compose(position, layout), { height: '100%' });
@@ -149,7 +150,12 @@ export const Markdown = forwardRef<
         .use(remark2rehype, { allowDangerousHtml: true })
         .use(remarkRaw)
         .use(rehype2react, {
-          createElement,
+          // @ts-expect-error: the react types are missing.
+          Fragment: production.Fragment,
+          // @ts-expect-error: the react types are missing.
+          jsx: production.jsx,
+          // @ts-expect-error: the react types are missing.
+          jsxs: production.jsxs,
           components: componentMapWithPassedThroughProps
         });
 
@@ -172,7 +178,10 @@ export const Markdown = forwardRef<
         .use(remark2rehype, { allowDangerousHtml: true })
         .use(remarkRaw)
         .use(rehype2react, {
-          createElement,
+          // @ts-expect-error: the react types are missing.
+          jsx: production.jsx,
+          // @ts-expect-error: the react types are missing.
+          jsxs: production.jsxs,
           Fragment: Notes
         });