Repository navigation
Override markdown-it to 15.0.3 for GHSA-r7fv-28h4-cvq7 - #4267
Merged
Merged
Conversation
markdownlint-cli2 0.23.3, the latest release, pins markdown-it to exactly 15.0.1, so neither Dependabot nor a parent bump can fix this. An override is the same remedy edu uses for smol-toml. The floor is 15.0.3, not 15.0.2: 15.0.3 also fixes GHSA-vfgh-jcmw-g37q and GHSA-gfr2-rv44-r23c. It was published 2026-10-16, which clears the 3-day npm cooldown check. The only other lockfile change is markdown-it's nested argparse, 3.0.2 to 3.0.3 (published 2026-10-15). Exposure was nil: the smartquotes bug needs typographer: true, and edu's markdownlint config loads no markdown-it plugins. CI's pre-commit hook builds markdownlint-cli2 from upstream with its own pin, so this change closes Dependabot alert 188 but does not change the linter CI runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
s-stumbo
approved these changes
Oct 20, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes Dependabot alert 188 (CVE-2026-111759, high): markdown-it's smartquotes rule takes quadratic time on unmatched closing quotes.
markdownlint-cli20.23.3, the latest release, pinsmarkdown-itto exactly 15.0.1, so neither Dependabot nor a parent bump can fix this. This PR adds anoverridesentry, as we did for smol-toml.The floor is 15.0.3 rather than 15.0.2 because 15.0.3 also fixes GHSA-vfgh-jcmw-g37q and GHSA-gfr2-rv44-r23c. It clears the 3-day npm cooldown check. The only other lockfile change is markdown-it's nested
argparse(3.0.2 → 3.0.3).Exposure: none in practice. The bug needs
typographer: true, and our markdownlint config loads no markdown-it plugins. CI's pre-commit hook builds markdownlint-cli2 from upstream with its own pin, so this closes the alert without changing the linter CI runs.Testing:
npm ciis clean;npm auditno longer reports markdown-it; markdownlint passes on all 441 content files. The advisory's reproduction took 1946 ms on 15.0.1 and 4 ms on 15.0.3 (192,000-character input).🤖 Generated with Claude Code
Created in collaboration with Claude Code running Claude Opus 5.5 on 2026-10-20.