Page MenuHomePhabricator
Differential D20486

[monorepo] Override linkify-it 5.0.2 for markdown-it DoS fixes
ClosedPublic
Actions

Authored by bytesofman on Wed, Aug 19, 03:23.

Details

Reviewers
Fabien
Group Reviewers
Restricted Project
Commits
rABC1948c883079f: [monorepo] Override linkify-it 5.0.2 for markdown-it DoS fixes
Summary

Force linkify-it 5.x past 5.0.1 so b58-ts typedoc's markdown-it picks up patches for GHSA-22p9-wv53-3rq4 and GHSA-v245-v573-v5vm (high).

Test Plan
  • pnpm install --lockfile-only
  • rg 'linkify-it@' pnpm-lock.yaml # 5.0.2 only
  • pnpm audit --audit-level high # linkify-it GHSAs gone; high 11→9

Diff Detail

Repository
rABC Bitcoin ABC
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

bytesofman created this revision.Wed, Aug 19, 03:23
teamcity added a comment.Wed, Aug 19, 03:34

Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review

Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────

(\(\
(• .•) Blink twice if you're a bug.

────────────────────────────────────────
Review complete
No findings ✔

2 files reviewed:

  • pnpm-lock.yaml
  • pnpm-workspace.yaml

────────────────────────────────────────

Harbormaster completed remote builds in B37872: Diff 60917.Wed, Aug 19, 03:39
bytesofman published this revision for review.Thu, Aug 20, 02:55
Fabien accepted this revision.Thu, Aug 20, 07:28
This revision is now accepted and ready to land.Thu, Aug 20, 07:28
bytesofman updated this revision to Diff 60934.Thu, Aug 20, 07:32

Rebase onto latest master. Keep the landed nanoid 3.3.18 override and add the linkify-it 5.0.2 pin.

teamcity added a comment.Thu, Aug 20, 07:51

Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review

Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────

(\(\
(• .•) If you don't make mistakes, you're not working on hard enough problems. - Frank Wilczek

────────────────────────────────────────
Review complete
No findings ✔

2 files reviewed:

  • pnpm-lock.yaml
  • pnpm-workspace.yaml

────────────────────────────────────────

Harbormaster completed remote builds in B37886: Diff 60934.Thu, Aug 20, 08:18
Closed by commit rABC1948c883079f: [monorepo] Override linkify-it 5.0.2 for markdown-it DoS fixes (authored by bytesofman). · Explain WhyThu, Aug 20, 08:27
This revision was automatically updated to reflect the committed changes.
bytesofman added a commit: rABC1948c883079f: [monorepo] Override linkify-it 5.0.2 for markdown-it DoS fixes.

Revision Contents
Changeset List

Diff 60936

View Options

pnpm-lock.yaml

Loading...
View Options

pnpm-workspace.yaml

Loading...