Skip to content

Commit

Permalink
chore(deps): bump marked from 0.7.0 to 4.3.0
Browse files Browse the repository at this point in the history
This pull request updates marked to version ^4.3.0 to fix current security vulnerabilities. The `parseInline()` function is used in place of `inlineLexer()`. 

Also deployed on portal and in the le in this [pr](codecademy-engineering/mono#2819).

Please note in order for this to pass tests in monorepo, I needed to set the `mangle: false` in the markedOptions, in packages/gamut/src/Markdown/index.tsx. E

```
 const markedOptions = {
      smartypants: true,
      headerIds,
      headerPrefix: 'heading-',
      mangle: false,
    };
```
Mangle is mentioned in the documentation [here](https://marked.js.org/using_advanced) and is deprecated in the most recent version of marked in favor of the marked-mangle package. Mangling is used for mailto links to prevent email harvesting bots from collecting email addresses from websites. Currently, we are not mangling emails on prod.
  • Loading branch information
BandanaKM authored Aug 2, 2023
1 parent cfd9c74 commit 691c9a3
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 12 deletions.
4 changes: 2 additions & 2 deletions packages/gamut/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -32,13 +32,13 @@
"@codecademy/variance": "0.21.0",
"@reach/auto-id": "^0.16.0",
"@reach/tabs": "^0.16.4",
"@types/marked": "^1.1.0",
"@types/marked": "^4.0.8",
"classnames": "^2.2.5",
"framer-motion": "^6.5.1",
"html-to-react": "^1.5.0",
"invariant": "^2.2.4",
"lodash": "^4.17.5",
"marked": "^0.7.0",
"marked": "^4.3.0",
"polished": "^4.1.2",
"react-aria-tabpanel": "^4.4.0",
"react-focus-on": "^3.5.1",
Expand Down
5 changes: 3 additions & 2 deletions packages/gamut/src/Markdown/index.tsx
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import cx from 'classnames';
import HtmlToReact from 'html-to-react';
import marked from 'marked';
import { marked } from 'marked';
import { PureComponent } from 'react';
import * as React from 'react';
import sanitizeMarkdown from 'sanitize-markdown';
Expand Down Expand Up @@ -130,11 +130,12 @@ export class Markdown extends PureComponent<MarkdownProps> {
smartypants: true,
headerIds,
headerPrefix: 'heading-',
mangle: false,
};

// Render markdown to html
const rawHtml = inline
? marked.inlineLexer(text, [], markedOptions)
? marked.parseInline(text, markedOptions)
: marked(text, markedOptions);

const sanitizationConfig = {
Expand Down
16 changes: 8 additions & 8 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -6386,10 +6386,10 @@
dependencies:
"@types/react" "*"

"@types/marked@^1.1.0":
version "1.2.2"
resolved "https://registry.npmjs.org/@types/marked/-/marked-1.2.2.tgz#1f858a0e690247ecf3b2eef576f98f86e8d960d4"
integrity sha512-wLfw1hnuuDYrFz97IzJja0pdVsC0oedtS4QsKH1/inyW9qkLQbXgMUqEQT0MVtUBx3twjWeInUfjQbhBVLECXw==
"@types/marked@^4.0.8":
version "4.3.1"
resolved "https://registry.npmjs.org/@types/marked/-/marked-4.3.1.tgz#45fb6dfd47afb595766c71ed7749ead23f137de3"
integrity sha512-vSSbKZFbNktrQ15v7o1EaH78EbWV+sPQbPjHG+Cp8CaNcPFUEfjZ0Iml/V0bFDwsTlYe8o6XC5Hfdp91cqPV2g==

"@types/mdast@^3.0.0":
version "3.0.3"
Expand Down Expand Up @@ -16090,10 +16090,10 @@ markdown-to-jsx@^7.1.3:
resolved "https://registry.npmjs.org/markdown-to-jsx/-/markdown-to-jsx-7.1.3.tgz#f00bae66c0abe7dd2d274123f84cb6bd2a2c7c6a"
integrity sha512-jtQ6VyT7rMT5tPV0g2EJakEnXLiPksnvlYtwQsVVZ611JsWGN8bQ1tVSDX4s6JllfEH6wmsYxNjTUAMrPmNA8w==

marked@^0.7.0:
version "0.7.0"
resolved "https://registry.npmjs.org/marked/-/marked-0.7.0.tgz#b64201f051d271b1edc10a04d1ae9b74bb8e5c0e"
integrity sha512-c+yYdCZJQrsRjTPhUx7VKkApw9bwDkNbHUKo1ovgcfDjb2kc8rLuRbIFyXL5WOEUwzSSKo3IXpph2K6DqB/KZg==
marked@^4.3.0:
version "4.3.0"
resolved "https://registry.npmjs.org/marked/-/marked-4.3.0.tgz#796362821b019f734054582038b116481b456cf3"
integrity sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A==

md5.js@^1.3.4:
version "1.3.5"
Expand Down

0 comments on commit 691c9a3

Please sign in to comment.