From 7cada2b268cad0d8cec3276ad8702a1826f6ca0f Mon Sep 17 00:00:00 2001 From: Roman Vyakhirev Date: Thu, 16 Jul 2026 15:59:22 +0200 Subject: [PATCH] fix(markdown-web): bump markdown-it to 14.3.0 to fix linkify-it CVE-2026-59887 --- .../markdown-web/CHANGELOG.md | 4 ++++ .../markdown-web/package.json | 4 ++-- pnpm-lock.yaml | 24 +++++++++---------- 3 files changed, 18 insertions(+), 14 deletions(-) diff --git a/packages/pluggableWidgets/markdown-web/CHANGELOG.md b/packages/pluggableWidgets/markdown-web/CHANGELOG.md index 369b5c21f9..d19b0f0b35 100644 --- a/packages/pluggableWidgets/markdown-web/CHANGELOG.md +++ b/packages/pluggableWidgets/markdown-web/CHANGELOG.md @@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ## [Unreleased] +### Security + +- Updated markdown-it library to version 14.3.0 to incorporate latest security fixes. + ## [1.0.2] - 2026-04-13 ### Changed diff --git a/packages/pluggableWidgets/markdown-web/package.json b/packages/pluggableWidgets/markdown-web/package.json index 4dae04d5d5..b22c8e31d6 100644 --- a/packages/pluggableWidgets/markdown-web/package.json +++ b/packages/pluggableWidgets/markdown-web/package.json @@ -46,7 +46,7 @@ "dependencies": { "@mendix/widget-plugin-component-kit": "workspace:*", "classnames": "^2.5.1", - "markdown-it": "^14.1.1" + "markdown-it": "^14.3.0" }, "devDependencies": { "@mendix/automation-utils": "workspace:*", @@ -58,6 +58,6 @@ "@mendix/widget-plugin-hooks": "workspace:*", "@mendix/widget-plugin-platform": "workspace:*", "@mendix/widget-plugin-test-utils": "workspace:*", - "@types/markdown-it": "^14.1.1" + "@types/markdown-it": "^14.1.2" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 52d7918eda..5e29fa4ebf 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1838,7 +1838,7 @@ importers: version: link:../../shared/eslint-config-web-widgets '@mendix/pluggable-widgets-tools': specifier: 11.11.0 - version: 11.11.0(patch_hash=036a1e3d1a57e7418725babb71e5eef5220ae90fc481ad7e04fa7e8901b25801)(@jest/transform@30.3.0)(@jest/types@30.4.1)(@swc/core@1.15.41)(@types/babel__core@7.20.5)(@types/node@24.12.4)(canvas@3.2.3)(eslint@9.39.4(jiti@2.6.1))(jest-util@30.4.1)(picomatch@4.0.4)(prettier@3.8.4)(react-dom@18.3.1(react@18.3.1))(react-native@0.86.0(@babel/core@7.29.7)(@types/react@19.2.17)(react@18.3.1))(react@18.3.1)(tslib@2.8.1) + version: 11.11.0(patch_hash=036a1e3d1a57e7418725babb71e5eef5220ae90fc481ad7e04fa7e8901b25801)(@jest/transform@30.3.0)(@jest/types@30.4.1)(@swc/core@1.15.41)(@types/babel__core@7.20.5)(@types/node@24.12.4)(canvas@3.2.3)(eslint@9.39.4(jiti@2.6.1))(jest-util@30.4.1)(prettier@3.8.4)(react-dom@18.3.1(react@18.3.1))(react-native@0.86.0(@babel/core@7.29.7)(@types/react@19.2.17)(react@18.3.1))(react@18.3.1)(tslib@2.8.1) '@mendix/prettier-config-web-widgets': specifier: workspace:* version: link:../../shared/prettier-config-web-widgets @@ -1876,8 +1876,8 @@ importers: specifier: ^2.5.1 version: 2.5.1 markdown-it: - specifier: ^14.1.1 - version: 14.2.0 + specifier: ^14.3.0 + version: 14.3.0 devDependencies: '@mendix/automation-utils': specifier: workspace:* @@ -1907,7 +1907,7 @@ importers: specifier: workspace:* version: link:../../shared/widget-plugin-test-utils '@types/markdown-it': - specifier: ^14.1.1 + specifier: ^14.1.2 version: 14.1.2 packages/pluggableWidgets/pie-doughnut-chart-web: @@ -2813,7 +2813,7 @@ importers: devDependencies: '@mendix/pluggable-widgets-tools': specifier: 11.11.0 - version: 11.11.0(patch_hash=036a1e3d1a57e7418725babb71e5eef5220ae90fc481ad7e04fa7e8901b25801)(@jest/transform@30.3.0)(@jest/types@30.4.1)(@swc/core@1.15.41)(@types/babel__core@7.20.5)(@types/node@24.12.4)(canvas@3.2.3)(eslint@9.39.4(jiti@2.6.1))(jest-util@30.4.1)(picomatch@4.0.4)(prettier@3.8.4)(react-dom@18.3.1(react@18.3.1))(react-native@0.86.0(@babel/core@7.29.7)(@types/react@19.2.17)(react@18.3.1))(react@18.3.1)(tslib@2.8.1) + version: 11.11.0(patch_hash=036a1e3d1a57e7418725babb71e5eef5220ae90fc481ad7e04fa7e8901b25801)(@jest/transform@30.3.0)(@jest/types@30.4.1)(@swc/core@1.15.41)(@types/babel__core@7.20.5)(@types/node@24.12.4)(canvas@3.2.3)(eslint@9.39.4(jiti@2.6.1))(jest-util@30.4.1)(prettier@3.8.4)(react-dom@18.3.1(react@18.3.1))(react-native@0.86.0(@babel/core@7.29.7)(@types/react@19.2.17)(react@18.3.1))(react@18.3.1)(tslib@2.8.1) rollup-plugin-copy: specifier: ^3.5.0 version: 3.5.0 @@ -8553,8 +8553,8 @@ packages: lines-and-columns@1.2.4: resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==} - linkify-it@5.0.1: - resolution: {integrity: sha512-wVoTjP4Q6R0NW5hiZkVJaFZPWgtXfoGF+6LucL3/FtiNjmcHhYjEr5f1Kqjirc1nBW07J/ZuRFumqr2oqccEWg==} + linkify-it@5.0.2: + resolution: {integrity: sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==} linkifyjs@4.3.3: resolution: {integrity: sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg==} @@ -8711,8 +8711,8 @@ packages: resolution: {integrity: sha512-lgL7XpIwsgICiL82ITplfS7IGwrB1OJIw/pCvprDp2dhmSSEBgmPzYRvwYYYvJGJD7fxUv1Tvpih4nZ6VrLuaA==} engines: {node: '>=16.14.0', npm: '>=8.1.0'} - markdown-it@14.2.0: - resolution: {integrity: sha512-1TGiQiJVRQ3NPmZH6sx5Cfnmg6GQm9jvC1ch4TK511NjSJvjzKLzn5pPfZRNZkRPZP0HqCioSndqH8v2nRaWVQ==} + markdown-it@14.3.0: + resolution: {integrity: sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==} hasBin: true marky@1.3.0: @@ -18286,7 +18286,7 @@ snapshots: lines-and-columns@1.2.4: {} - linkify-it@5.0.1: + linkify-it@5.0.2: dependencies: uc.micro: 2.1.0 @@ -18469,11 +18469,11 @@ snapshots: tinyqueue: 3.0.0 vt-pbf: 3.1.3 - markdown-it@14.2.0: + markdown-it@14.3.0: dependencies: argparse: 2.0.1 entities: 4.5.0 - linkify-it: 5.0.1 + linkify-it: 5.0.2 mdurl: 2.0.0 punycode.js: 2.3.1 uc.micro: 2.1.0