New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remarkable Dependency Vulnerability #156

Open

KarinBlanford opened this issue Dec 17, 2019 · 0 comments

KarinBlanford commented Dec 17, 2019

The dependency Remarkable has been updated to use autolinker v3.0.0+ as there was a DOS vulnerability in autolinker v0.28.1 (https://snyk.io/vuln/SNYK-JS-AUTOLINKER-73494).

Updating Remarkable to v2.0.0+ will resolve the issue.

Old - https://github.com/jonschlinkert/remarkable/blob/v1.7.4/package.json#L66
New - https://github.com/jonschlinkert/remarkable/blob/v2.0.0/package.json#L81

Currently unable to install markdown-toc due to older version of autolinker being quarantined on corporate npm registry.

tklever mentioned this issue

chore: upgrade remarkable to ^2.0.0 jonschlinkert/gulp-format-md#3

Open

KarinBlanford mentioned this issue

updating Remarkable dep to resolve subdependency DOS vulnerability #157

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment