🚨 [security] Update gatsby-transformer-remark 2.16.1 → 6.15.0 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ gatsby-transformer-remark (2.16.1 → 6.15.0) · Repo · Changelog

Security Advisories 🚨

🚨 gatsby-transformer-remark has possible unsanitized JavaScript code injection

Impact

The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build server.

To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark. The following payload demonstrates a vulnerable configuration:

---js
((require("child_process")).execSync("id >> /tmp/rce"))
--- 

Patches

A patch has been introduced in [email protected] and [email protected] which mitigates the issue by disabling the gray-matter JavaScript Frontmatter engine. The patch introduces a new option, JSFrontmatterEngine which is set to false by default. When setting JSFrontmatterEngine to true, input passed to gatsby-plugin-mdx must be sanitized before processing to avoid a security risk. Warnings are displayed when enabling JSFrontmatterEngine to true or if it appears that the MarkdownRemark input is attempting to use the Frontmatter engine.

Workarounds

If an older version of gatsby-transformer-remark must be used, input passed into the plugin should be sanitized ahead of processing.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

For more information

Email us at [email protected].

🚨 gatsby-transformer-remark has possible unsanitized JavaScript code injection

Impact

The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build server.

To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark. The following payload demonstrates a vulnerable configuration:

---js
((require("child_process")).execSync("id >> /tmp/rce"))
--- 

Patches

A patch has been introduced in [email protected] and [email protected] which mitigates the issue by disabling the gray-matter JavaScript Frontmatter engine. The patch introduces a new option, JSFrontmatterEngine which is set to false by default. When setting JSFrontmatterEngine to true, input passed to gatsby-plugin-mdx must be sanitized before processing to avoid a security risk. Warnings are displayed when enabling JSFrontmatterEngine to true or if it appears that the MarkdownRemark input is attempting to use the Frontmatter engine.

Workarounds

If an older version of gatsby-transformer-remark must be used, input passed into the plugin should be sanitized ahead of processing.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

For more information

Email us at [email protected].

↗️ hast-to-hyperscript (indirect, 5.0.0 → 9.0.1) · Repo

Release Notes

9.0.1

• d22f2b4 Refactor to improve bundle size
• e5b3579 Fix typo

9.0.0

• 22c7855 Add types
  (breaking, potentially, if you or your dependents use typescript)

8.1.1

• 8ff34e9 Fix to specify minimum needed property-information version

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ hast-util-from-parse5 (indirect, 4.0.2 → 6.0.1) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ hast-util-raw (indirect, 4.0.0 → 6.1.0) · Repo

Release Notes

6.1.0

• f64e56f Add support for options.passThrough

6.0.2

• 84a8113 Fix to reset parser before correct elements, etc

6.0.1

• 74b03c0 Fix support for template elements

6.0.0

• 6e3146f Update dependencies
• e21922d Add types
  (breaking, potentially, if you or your dependents use typescript)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ hast-util-to-html (indirect, 4.0.1 → 7.1.3) · Repo

Release Notes

7.1.3

• e26628c Fix SVG attributes on svg element in HTML

7.1.2

• 0116d07 Refactor to improve bundle size

7.1.1

• 0dc5101 types: make optional fields optional

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ hastscript (indirect, 4.1.0 → 6.0.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mdast-util-definitions (indirect, 1.2.5 → 4.0.0) · Repo

Release Notes

4.0.0

• 24fd914 Change to match CommonMark

3.0.1

• 04d142e Move mdast types to dev dependency

3.0.0

• 8e28095 Add types

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mdast-util-to-hast (indirect, 3.0.4 → 10.2.0) · Repo

Release Notes

10.2.0

• c339702 Add mdast code.meta to hast as code.data.meta

10.1.1

• 703a652 Fix exception on node.data set to undefined

10.1.0

• a497990 Add passThrough option to keep custom nodes

10.0.1

• 197247c Fix support for hName on non-element

10.0.0

• 142e973 Change to match CommonMark
• 29c0146 Fix typo in types

9.1.2

• c3e033d Fix support for tables w/o align
• 84c85f7 Fix to not add a tbody if there is one row

9.1.1

• 11dad16 Fix line endings in tight list items
• 15a21f1 Fix multiple line endings in text
• 914a6b7 Fix tabs in code
• 96a1161 Fix whitespace in inline code
• 18e5051 Add docs on align

9.1.0

• 960a349 types: add subtypes as direct dependencies

9.0.1

• 3e30b29 Move mdast types to dev dependencies

9.0.0

• 345e61c Add types
  (breaking, potentially, if you or your dependents use typescript)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ property-information (indirect, 4.2.0 → 5.6.0) · Repo

Release Notes

5.6.0

• c523342 Add loading

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ remark-retext (indirect, 3.1.3 → 4.0.0) · Repo

Release Notes

4.0.0

• cff4538 Update mdast-util-to-nlcst
  (breaking, potentially, if you or your dependents use typescript)
• 0b0e0a7 Refactor prose
• 72b1adb Add notes on security

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sanitize-html (indirect, 1.27.5 → 2.17.0) · Repo · Changelog

Security Advisories 🚨

🚨 sanitize-html Information Exposure vulnerability

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.

🚨 Sanitize-html Vulnerable To REDoS Attacks

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

🚨 Improper Input Validation in sanitize-html

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

🚨 Improper Input Validation in sanitize-html

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\example.com".

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ unist-builder (indirect, 1.0.4 → 2.0.3) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ unist-util-select (indirect, 1.5.0 → 3.0.4) · Repo

Release Notes

3.0.4

• 5da284c Remove circular dependency

3.0.3

• 732da9a Update nth-check

3.0.2

• d48ac1c Refactor to improve bundle size
• c7dc44b Refactor prose

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 @​lmdb/lmdb-darwin-arm64 (added, 2.5.3)

🆕 @​lmdb/lmdb-darwin-x64 (added, 2.5.3)

🆕 @​lmdb/lmdb-linux-arm (added, 2.5.3)

🆕 @​lmdb/lmdb-linux-arm64 (added, 2.5.3)

🆕 @​lmdb/lmdb-linux-x64 (added, 2.5.3)

🆕 @​lmdb/lmdb-win32-x64 (added, 2.5.3)

🆕 @​msgpackr-extract/msgpackr-extract-darwin-arm64 (added, 3.0.3)

🆕 @​msgpackr-extract/msgpackr-extract-darwin-x64 (added, 3.0.3)

🆕 @​msgpackr-extract/msgpackr-extract-linux-arm (added, 3.0.3)

🆕 @​msgpackr-extract/msgpackr-extract-linux-arm64 (added, 3.0.3)

🆕 @​msgpackr-extract/msgpackr-extract-linux-x64 (added, 3.0.3)

🆕 @​msgpackr-extract/msgpackr-extract-win32-x64 (added, 3.0.3)

🆕 @​types/cacheable-request (added, 6.0.3)

🆕 @​types/http-cache-semantics (added, 4.0.4)

🆕 @​types/keyv (added, 3.1.4)

🆕 @​types/parse5 (added, 5.0.3)

🆕 @​types/responselike (added, 1.0.3)

🆕 cacheable-lookup (added, 5.0.4)

🆕 deepmerge (added, 4.3.1)

🆕 hash-wasm (added, 4.12.0)

🆕 http2-wrapper (added, 1.0.3)

🆕 lmdb (added, 2.5.3)

🆕 mdast-util-find-and-replace (added, 1.1.1)

🆕 mdast-util-footnote (added, 0.1.7)

🆕 mdast-util-gfm (added, 0.1.2)

🆕 mdast-util-gfm-autolink-literal (added, 0.1.3)

🆕 mdast-util-gfm-strikethrough (added, 0.2.3)

🆕 mdast-util-gfm-table (added, 0.1.6)

🆕 mdast-util-gfm-task-list-item (added, 0.1.6)

🆕 micromark-extension-footnote (added, 0.3.2)

🆕 micromark-extension-gfm (added, 0.3.3)

🆕 micromark-extension-gfm-autolink-literal (added, 0.5.7)

🆕 micromark-extension-gfm-strikethrough (added, 0.6.5)

🆕 micromark-extension-gfm-table (added, 0.4.3)

🆕 micromark-extension-gfm-tagfilter (added, 0.3.0)

🆕 micromark-extension-gfm-task-list-item (added, 0.3.3)

🆕 msgpackr (added, 1.11.5)

🆕 msgpackr-extract (added, 3.0.3)

🆕 nanoid (added, 3.3.11)

🆕 node-gyp-build-optional-packages (added, 5.0.3)

🆕 not (added, 0.1.0)

🆕 ordered-binary (added, 1.6.0)

🆕 remark-footnotes (added, 3.0.0)

🆕 remark-gfm (added, 1.0.0)

🆕 resolve-alpn (added, 1.2.1)

🆕 source-map-js (added, 1.2.1)

🆕 weak-lru-cache (added, 1.2.2)

🗑️ detab (removed)

🗑️ trim-lines (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview