Skip to content

Conversation

@renovate
Copy link

@renovate renovate bot commented Aug 26, 2020

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
prismjs 1.16.0 -> 1.21.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2020-15138

Impact

The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.

This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0).

Patches

This problem is patched in v1.21.0.

Workarounds

To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

References

The vulnerability was introduced by this commit on Sep 29, 2015 and fixed by Masato Kinugawa (#​2506).

For more information

If you have any questions or comments about this advisory, please open an issue.


Release Notes

PrismJS/prism

v1.21.0

Compare Source

New components
Updated components
Updated plugins
Updated themes
  • Coy
  • Default
    • Added a comment that declares the background color of operator tokens as intentional (#​2309) 937e2691
  • Okaidia
    • Update comment text color to meet WCAG contrast recommendations to AA level (#​2292) 06495f90
Other

v1.20.0

Compare Source

New components
Updated components
New plugins
Updated plugins
Other

v1.19.0

Compare Source

New components
Updated components
Updated plugins
Updated themes
Other

v1.18.0

Compare Source

New components
Updated components
Updated plugins
Other

v1.17.1

Compare Source

Other
  • Infrastructure

v1.17.0

Compare Source

New components
New plugins
Updated components
Updated plugins

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot changed the title Update dependency prismjs to v1.21.0 [SECURITY] chore(deps): update dependency prismjs to v1.21.0 [security] Oct 28, 2020
@renovate renovate bot changed the title chore(deps): update dependency prismjs to v1.21.0 [security] chore(deps): update dependency prismjs to 1.23.0 [security] Apr 26, 2021
@renovate renovate bot changed the title chore(deps): update dependency prismjs to 1.23.0 [security] chore(deps): update dependency prismjs to 1.25.0 [security] Oct 19, 2021
@renovate renovate bot changed the title chore(deps): update dependency prismjs to 1.25.0 [security] chore(deps): update dependency prismjs to v1.21.0 [security] Mar 7, 2022
@renovate
Copy link
Author

renovate bot commented Mar 24, 2023

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@renovate renovate bot changed the title chore(deps): update dependency prismjs to v1.21.0 [security] chore(deps): update dependency prismjs to v1.21.0 [security] - abandoned Dec 8, 2024
@renovate
Copy link
Author

renovate bot commented Dec 8, 2024

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant