[Snyk] Upgrade prismjs from 1.18.0 to 1.23.0 #10

snyk-bot · 2021-06-01T01:29:34Z

Snyk has created this PR to upgrade prismjs from 1.18.0 to 1.23.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 5 versions ahead of your current version.
The recommended version was released 5 months ago, on 2020-12-31.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Cross-site Scripting (XSS) SNYK-JS-PRISMJS-597628	629/1000 Why? Has a fix available, CVSS 8.3	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PRISMJS-1076581	629/1000 Why? Has a fix available, CVSS 8.3	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: prismjs

1.23.0 - 2020-12-31
New components
- Apex (#2622) f0e2b70e
- DataWeave (#2659) 0803525b
- PromQL (#2628) 8831c706
Updated components
- Fixed multiple vulnerable regexes (#2584) c2f6a644
- Apache Configuration
  - Update directive-flag to match = (#2612) 00bf00e3
- C-like
  - Made all comments greedy (#2680) 0a3932fe
- C
  - Better class name and macro name detection (#2585) 129faf5c
- Content-Security-Policy
  - Added missing directives and keywords (#2664) f1541342
  - Do not highlight directive names with adjacent hyphens (#2662) a7ccc16d
- CSS
  - Better HTML style attribute tokenization (#2569) b04cbafe
- Java
  - Improved package and class name detection (#2599) 0889bc7c
  - Added Java 15 keywords (#2567) 73f81c89
- Java stack trace
  - Added support stack frame element class loaders and modules (#2658) 0bb4f096
- Julia
  - Removed constants that are not exported by default (#2601) 093c8175
- Kotlin
  - Added support for backticks in function names (#2489) a5107d5c
- Latte
  - Fixed exponential backtracking (#2682) 89f1e182
- Markdown
  - Improved URL tokenization (#2678) 2af3e2c2
  - Added support for YAML front matter (#2634) 5cf9cfbc
- PHP
  - Added support for PHP 7.4 + other major improvements (#2566) 38808e64
  - Added support for PHP 8.0 features (#2591) df922d90
  - Removed C-like dependency (#2619) 89ebb0b7
  - Fixed exponential backtracking (#2684) 37b9c9a1
- Sass (Scss)
  - Added support for Sass modules (#2643) deb238a6
- Scheme
  - Fixed number pattern (#2648) e01ecd00
  - Fixed function and function-like false positives (#2611) 7951ca24
- Shell session
  - Fixed false positives because of links in command output (#2649) 8e76a978
- TSX
  - Temporary fix for the collisions of JSX tags and TS generics (#2596) 25bdb494
Updated plugins
- Made Autoloader and Diff Highlight compatible (#2580) 7a74497a
- Copy to Clipboard Button
  - Set type="button" attribute for copy to clipboard plugin (#2593) f59a85f1
- File Highlight
  - Fixed IE compatibility problem (#2656) 3f4ae00d
- Line Highlight
  - Fixed top offset in combination with Line numbers (#2237) b40f8f4b
  - Fixed print background color (#2668) cdb24abe
- Line Numbers
  - Fixed null reference (#2605) 7cdfe556
- Treeview
  - Fixed icons on dark themes (#2631) 7266e32f
- Unescaped Markup
  - Refactoring (#2445) fc602822
Other
- Readme: Added alternative link for Chinese translation 071232b4
- Readme: Removed broken icon for Chinese translation (#2670) 2ea202b9
- Readme: Grammar adjustments (#2629) f217ab75
- Core
  - Moved pattern matching + lookbehind logic into function (#2633) 24574406
  - Fixed bug with greedy matching (#2632) 8fa8dd24
- Infrastructure
  - Migrate from TravisCI -> GitHub Actions (#2606) 69132045
  - Added Dangerfile and provide bundle size info (#2608) 9df20c5e
  - New start script to start local server (#2491) 0604793c
  - Added test for exponential backtracking (#2590) 05afbb10
  - Added test for polynomial backtracking (#2597) e644178b
  - Tests: Better pretty print (#2600) 8bfcc819
  - Tests: Fixed sorted language list test (#2623) 2d3a1267
  - Tests: Stricter pattern for nice-token-names test (#2588) 0df60be1
  - Tests: Added strict checks for Prism.languages.extend (#2572) 8828500e
- Website
  - Test page: Added "Share" option (#2575) b5f4f10e
  - Test page: Don't trigger ad-blockers with class (#2677) df0738e9
  - Thousands -> millions 9f82de50
  - Unescaped Markup: More doc regarding comments (#2652) add3736a
  - Website: Added and updated documentation (#2654) 8e660495
  - Website: Updated and improved guide on "Extending Prism" page (#2586) 8e1f38ff
1.22.0 - 2020-10-10
Release 1.22.0
1.21.0 - 2020-08-06
Release 1.21.0
1.20.0 - 2020-04-04
Release 1.20.0
1.19.0 - 2020-01-13
Release 1.19.0
1.18.0 - 2020-01-04
Release 1.18.0

from prismjs GitHub release notes

Commit messages

Package name: prismjs

88a17b4 1.23.0
5dc7b42 Changelog v1.23.0 (child_process: execFile and fork arg parsing ambiguity nodejs/node#2681)
37b9c9a PHP: Fixed exponential backtracking ("Octal literals are not allowed in strict mode." is not a synax error nodejs/node#2684)
89f1e18 Latte: Fixed exponential backtracking (Merge vee-eight-4.5 into master nodejs/node#2682)
0a3932f C-like: Made all comments greedy (fs.realpath 70x slower than native nodejs/node#2680)
cdb24ab Line Highlight: Fixed print background color (Unreachable code in buffer.js and unsigned bitwise shifts. nodejs/node#2668)
e644178 Added test for polynomial backtracking (Object initializer for complex object( object inside object) nodejs/node#2597)
b40f8f4 Line highlight: Fixed top offset in combination with Line numbers (TCP socket unable to connect to localhost nodejs/node#2237)
2af3e2c Markdown: Improved URL tokenization (src: increment NODE_MODULE_VERSION to 46 nodejs/node#2678)
df0738e Test page: Don't trigger ad-blockers with class (http.IncomingMessage: fix forgotten 'message' to 'socket' nodejs/node#2677)
b5f4f10 Test page: Added "Share" option (crypto: Use OPENSSL_cleanse to shred the data. nodejs/node#2575)
0604793 New `start` script to start local server (tools: fix anchors in generated documents nodejs/node#2491)
8828500 Tests: Added strict checks for `Prism.languages.extend` (process: improve implement of process.uptime() nodejs/node#2572)
7266e32 Treeview: Fixed icons on dark themes ([3.2.0] Potential memory leak nodejs/node#2631)
7f23ef3 Fixed Danger CI for forks (doc: update COLLABORATOR_GUIDE nodejs/node#2638)
990f48f Fixed build
071232b Readme: Added alternative link for Chinese translation
fc57999 Bump ini from 1.3.5 to 1.3.7 (Investigate flaky test eval_messages nodejs/node#2672)
2ea202b README: Removed broken icon for Chinese translation (test: test-child-process-fork-net2 is flaky nodejs/node#2670)
9f82de5 thousands -> millions
f154134 CSP: Added missing directives and keywords (test: mark test-net-server-max-connections as flaky nodejs/node#2664)
a7ccc16 CSP: Do not highlight directive names with adjacent hyphens (test: mark test-vm-syntax-error-stderr as flaky nodejs/node#2662)
e01ecd0 Scheme: Fixed number pattern (test: mark eval_messages as flaky nodejs/node#2648)
05afbb1 Added test for exponential backtracking ([This is question] New node.js will provide the binary of master (develop) branch? nodejs/node#2590)

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade prismjs from 1.18.0 to 1.23.0. See this package in npm: https://www.npmjs.com/package/prismjs See this project in Snyk: https://app.snyk.io/org/define12/project/4ad07d72-6541-48b3-b08b-1371c0976fb9?utm_source=github&utm_medium=upgrade-pr

guardrails · 2021-06-01T01:31:59Z

⚠️ We detected 25 security issues in this pull request:

Vulnerable Libraries (25)

Severity	Details
Medium	[email protected] upgrade to `>5.7.3
High	[email protected] - no patch available
High	[email protected] upgrade to `>1.2.2
Medium	[email protected] upgrade to `>4.16.4`
High	[email protected] upgrade to `>=4.2.1`
High	[email protected] upgrade to `>=1.3.2
High	[email protected] upgrade to `>=4.2.1
High	[email protected] upgrade to `>6.5.3`
Medium	[email protected] upgrade to `>=2.8.9
High	[email protected] upgrade to `>=1.18.1`
High	[email protected] upgrade to `>4.17.20`
High	[email protected] upgrade to `>0.9.2`
High	[email protected] upgrade to `0.11.5`
Medium	[email protected] - no patch available
Medium	[email protected] - no patch available
High	[email protected] upgrade to `>=3.1.0`
Critical	[email protected] upgrade to `>2.3.0
Medium	[email protected] upgrade to `>6.0.1
High	[email protected] - no patch available
High	[email protected] upgrade to `>0.7.23`
High	[email protected] upgrade to `>=1.5.0`
High	[email protected] upgrade to `*`
Medium	[email protected] upgrade to `>=0.1.4`
Critical	[email protected] upgrade to `>1.6.1`
High	[email protected] upgrade to `>=5.0.5`

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Upgrade prismjs from 1.18.0 to 1.23.0 #10

[Snyk] Upgrade prismjs from 1.18.0 to 1.23.0 #10

Uh oh!

snyk-bot commented Jun 1, 2021

New components

Updated components

Updated plugins

Other

Uh oh!

guardrails bot commented Jun 1, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

[Snyk] Upgrade prismjs from 1.18.0 to 1.23.0 #10

Are you sure you want to change the base?

[Snyk] Upgrade prismjs from 1.18.0 to 1.23.0 #10

Uh oh!

Conversation

snyk-bot commented Jun 1, 2021

Snyk has created this PR to upgrade prismjs from 1.18.0 to 1.23.0.

New components

Updated components

Updated plugins

Other

Uh oh!

guardrails bot commented Jun 1, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants