chore: upgrade markdown-it to ^14.3.2 to address GHSA-253c-mchw-3w2r - #1702
Open
claude[bot] wants to merge 2 commits into
Open
claude[bot] wants to merge 2 commits into
claude[bot] wants to merge 2 commits into
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Contributor
License Audit❌ Audit failed to produce results. Check the workflow logs for details. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes SOU-2389
Summary
Refreshes the
yarn.lockentry for the transitive dependencymarkdown-itfrom14.2.0to14.3.2(patched floor14.3.1). It is requested via^14.1.1by@shikijs/markdown-itandcodemirror-json-schema.linkify: truehandling (rules_core/linkifyandrules_inline/linkify) that can block the event loop on a few hundred KB of markdown.The existing range already admits the patched version, so this is a lockfile-only refresh via
yarn up -R markdown-it. Nopackage.jsonchanges orresolutionsoverrides. The only other lockfile change is thelinkify-itdescriptor key moving from^5.0.1to^5.0.2, which still resolves to the already-locked5.0.2.Verification
yarn why markdown-it: every instance resolves tomarkdown-it@npm:14.3.2.yarn workspace @sourcebot/web test: 1506 passed.🤖 Generated with Claude Code
Note
Low Risk
Lockfile-only dependency patch for a known ReDoS-style linkify issue; no application code changes.
Overview
Bumps the locked transitive
markdown-itdependency from 14.2.0 to 14.3.2 (lockfile refresh only; nopackage.jsonor resolution changes) to pick up the GHSA-253c-mchw-3w2r fix for quadratic-timelinkifyparsing that could stall the event loop on large markdown inputs.The Unreleased changelog Fixed section documents the upgrade.
yarn.lockalso updatesmarkdown-it’s pinnedentitiesandlinkify-itdescriptor ranges as part of the resolved tree.Reviewed by Cursor Bugbot for commit 9c91e1e. Bugbot is set up for automated code reviews on this repo. Configure here.