fix: markdown syntax highlighting #316
Conversation
Minder Vulnerability Report
|
| Package | Version | #Vulnerabilities | #Fixes | Patch |
|---|---|---|---|---|
| trim | 0.0.1 | 1 | 1 | 0.0.3 |
Summary of vulnerabilities found
Minder found the following vulnerabilities in this PR:| Ecosystem | Name | Version | Vulnerability ID | Summary | Introduced | Fixed |
|---|---|---|---|---|---|---|
| npm | trim | 0.0.1 | GHSA-w5p7-h5w8-2hfq | Regular Expression Denial of Service in trim | 0 | 0.0.3 |
![stacklok-cloud-staging[bot]](https://avatars.githubusercontent.com/u/110237746?s=60&v=4){kind=small}
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
Pull Request Test Coverage Report for Build 13328529376Details
💛 - Coveralls |
alex-mcgovern
dismissed
stacklok-cloud-staging[bot]’s stale review
Not sure what minder is suggesting or if it will break things.
stacklok-cloud-staging
bot
dismissed
their stale review
Previous Minder review was dismissed because the PR was updated
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
There was a problem hiding this comment.
Dependency Information
Minder analyzed the dependencies introduced in this pull request and detected that some dependencies do not meet your security profile.
📦 Dependency: attach-ware
Archived packages are no longer updated or maintained. This can lead to security vulnerabilities and compatibility issues.
Scoring details
| Component | Score |
|---|---|
| Package activity | 3.9 |
| Repository activity | 1.2 |
| User activity | 6.6 |
| Provenance | historical_provenance_match |
Proof of Origin (Provenance)
This package can be linked back to its source code using a historical provenance map.
We were able to correlate a significant number of git tags and tagged releases in this package’s source code to versions of the published package. This mapping creates a strong link from the package back to its source code repository, verifying proof of origin.
| Published package versions | 1 |
| Number of git tags or releases | 3 |
| Versions matched to tags or releases | 1 |
📦 Dependency: hast
Scoring details
| Component | Score |
|---|---|
| Package activity | 5.7 |
| Repository activity | 3.6 |
| User activity | 7.9 |
| Provenance | unknown |
Alternatives
| Package | Description |
|---|---|
| rehype |
📦 Dependency: lower-case
Scoring details
| Component | Score |
|---|---|
| Package activity | 6.5 |
| Repository activity | 4.6 |
| User activity | 8.4 |
| Provenance | historical_provenance_mismatched |
📦 Dependency: param-case
Scoring details
| Component | Score |
|---|---|
| Package activity | 6.5 |
| Repository activity | 4.6 |
| User activity | 8.4 |
| Provenance | unknown |
📦 Dependency: sentence-case
Scoring details
| Component | Score |
|---|---|
| Provenance | unknown |
Alternatives
| Package | Description |
|---|---|
| title-case | |
| to-title-case |
📦 Dependency: trim
Archived packages are no longer updated or maintained. This can lead to security vulnerabilities and compatibility issues.
Scoring details
| Component | Score |
|---|---|
| Package activity | 5.2 |
| Repository activity | 1.3 |
| User activity | 9 |
| Provenance | unknown |
Alternatives
| Package | Description |
|---|---|
| lodash.trim | |
| string.prototype.trim | |
| trim-whitespace |
stacklok-cloud-staging
bot
dismissed
their stale review
Previous Minder review was dismissed because the PR was updated
| "version": "0.0.1", | ||
| "resolved": "https://registry.npmjs.org/trim/-/trim-0.0.1.tgz", | ||
| "integrity": "sha512-YzQV+TZg4AxpKxaTHK3c3D+kRDCGVEE7LemdlQZoQXn0iennk10RsIoY6ikzAqJTc9Xjl9C1/waHom/J86ziAQ==", | ||
| "deprecated": "Use String.prototype.trim() instead", | ||
| "dev": true | ||
| }, |
There was a problem hiding this comment.
| "version": "0.0.1", | |
| "resolved": "https://registry.npmjs.org/trim/-/trim-0.0.1.tgz", | |
| "integrity": "sha512-YzQV+TZg4AxpKxaTHK3c3D+kRDCGVEE7LemdlQZoQXn0iennk10RsIoY6ikzAqJTc9Xjl9C1/waHom/J86ziAQ==", | |
| "deprecated": "Use String.prototype.trim() instead", | |
| "dev": true | |
| }, | |
| "node_modules/trim": { | |
| "version": "0.0.1", | |
| 0.0.1 | |
| "version": "0.0.3", | |
| "resolved": "https://registry.npmjs.org/trim/-/trim-0.0.3.tgz", | |
| "integrity": "sha512-h82ywcYhHK7veeelXrCScdH7HkWfbIT1D/CgYO+nmDarz3SGNssVBMws6jU16Ga60AJCRAvPV6w6RLuNerQqjg==", |
There was a problem hiding this comment.
Dependency Information
Minder analyzed the dependencies introduced in this pull request and detected that some dependencies do not meet your security profile.
📦 Dependency: attach-ware
Archived packages are no longer updated or maintained. This can lead to security vulnerabilities and compatibility issues.
Scoring details
| Component | Score |
|---|---|
| Package activity | 3.9 |
| Repository activity | 1.2 |
| User activity | 6.6 |
| Provenance | historical_provenance_match |
Proof of Origin (Provenance)
This package can be linked back to its source code using a historical provenance map.
We were able to correlate a significant number of git tags and tagged releases in this package’s source code to versions of the published package. This mapping creates a strong link from the package back to its source code repository, verifying proof of origin.
| Published package versions | 1 |
| Number of git tags or releases | 3 |
| Versions matched to tags or releases | 1 |
📦 Dependency: hast
Scoring details
| Component | Score |
|---|---|
| Package activity | 5.7 |
| Repository activity | 3.6 |
| User activity | 7.9 |
| Provenance | unknown |
Alternatives
| Package | Description |
|---|---|
| rehype |
📦 Dependency: lower-case
Scoring details
| Component | Score |
|---|---|
| Package activity | 6.5 |
| Repository activity | 4.6 |
| User activity | 8.4 |
| Provenance | historical_provenance_mismatched |
📦 Dependency: param-case
Scoring details
| Component | Score |
|---|---|
| Package activity | 6.5 |
| Repository activity | 4.6 |
| User activity | 8.4 |
| Provenance | unknown |
📦 Dependency: sentence-case
Scoring details
| Component | Score |
|---|---|
| Provenance | unknown |
Alternatives
| Package | Description |
|---|---|
| title-case | |
| to-title-case |
📦 Dependency: trim
Archived packages are no longer updated or maintained. This can lead to security vulnerabilities and compatibility issues.
Scoring details
| Component | Score |
|---|---|
| Package activity | 5.2 |
| Repository activity | 1.3 |
| User activity | 9 |
| Provenance | unknown |
Alternatives
| Package | Description |
|---|---|
| lodash.trim | |
| string.prototype.trim | |
| trim-whitespace |
Fixes a long-standing bug with Syntax highlighting in markdown.
This should also allow us to allow @danbarr to document functionality (e.g. certificates) in plain markdown, rather than the current solution, which is limiting.
As an added bonus, the syntax theme is now based on colors from our palette, so should feel more consistent with the rest of the application, and respects the user's dark/light preference.
Before
After