Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update dependency gatsby-transformer-remark to v5 [security] #588

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Jan 11, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
gatsby-transformer-remark (source) 2.8.19 -> 5.25.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-22491

Impact

The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build server.

To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark. The following payload demonstrates a vulnerable configuration:

---js
((require("child_process")).execSync("id >> /tmp/rce"))
--- 

Patches

A patch has been introduced in [email protected] and [email protected] which mitigates the issue by disabling the gray-matter JavaScript Frontmatter engine. The patch introduces a new option, JSFrontmatterEngine which is set to false by default. When setting JSFrontmatterEngine to true, input passed to gatsby-plugin-mdx must be sanitized before processing to avoid a security risk. Warnings are displayed when enabling JSFrontmatterEngine to true or if it appears that the MarkdownRemark input is attempting to use the Frontmatter engine.

Workarounds

If an older version of gatsby-transformer-remark must be used, input passed into the plugin should be sanitized ahead of processing.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

For more information

Email us at [email protected].


Release Notes

gatsbyjs/gatsby (gatsby-transformer-remark)

v5.25.1

Compare Source

v5.25.0

Compare Source

v5.24.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.23.1 (2022-09-22)

Note: Version bump only for package gatsby-transformer-remark

v5.23.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.23.0

Compare Source

🧾 Release notes

Chores

v5.22.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.21.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.20.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.19.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.18.1 (2022-07-12)

Note: Version bump only for package gatsby-transformer-remark

v5.18.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.18.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.17.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.16.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.15.1 (2022-06-01)

Note: Version bump only for package gatsby-transformer-remark

v5.15.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.15.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.14.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.13.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.12.1 (2022-04-13)

Note: Version bump only for package gatsby-transformer-remark

v5.12.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.12.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.11.1 (2022-03-31)

Note: Version bump only for package gatsby-transformer-remark

v5.11.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.11.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.10.2 (2022-03-23)

Note: Version bump only for package gatsby-transformer-remark

5.10.1 (2022-03-18)

Note: Version bump only for package gatsby-transformer-remark

v5.10.2

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.10.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.10.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

5.9.1 (2022-03-09)

Note: Version bump only for package gatsby-transformer-remark

v5.9.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.9.0

Compare Source

🧾 Release notes

Chores
5.8.2 (2022-03-01)

Note: Version bump only for package gatsby-transformer-remark

5.8.1 (2022-02-25)

Note: Version bump only for package gatsby-transformer-remark

v5.8.2

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.8.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.8.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.7.0

Compare Source

🧾 Release notes

Bug Fixes
  • update dependency underscore.string to ^3.3.6 for gatsby-transformer-remark #​34653 (1d2530e)

v5.6.0

Compare Source

🧾 Release notes

Bug Fixes
5.5.2 (2022-01-17)

Note: Version bump only for package gatsby-transformer-remark

5.5.1 (2022-01-12)

Note: Version bump only for package gatsby-transformer-remark

v5.5.2

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.5.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.5.0

Compare Source

🧾 Release notes

Chores

v5.4.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.3.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v5.2.0

Compare Source

🧾 Release notes

Bug Fixes
5.1.4 (2021-11-15)

Note: Version bump only for package gatsby-transformer-remark

5.1.3 (2021-11-11)

Note: Version bump only for package gatsby-transformer-remark

5.1.2 (2021-11-10)

Note: Version bump only for package gatsby-transformer-remark

5.1.1 (2021-11-09)
Bug Fixes

v5.1.4

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.1.3

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.1.2

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v5.1.1

Compare Source

Bug Fixes

v5.1.0

Compare Source

🧾 Release notes

Bug Fixes
  • update minor and patch dependencies for gatsby-transformer-remark #​32613 (a1b315f)

v5.0.0

Compare Source

🧾 Release notes

Features
Chores
Other Changes

v4.12.0

Compare Source

v4.11.0

Compare Source

🧾 Release notes

Features
  • use subplugin annotation to use automatic subplugin module loading #​33039 (3260b1a)
Chores
Other Changes
  • Revert "chore(release): Publish next" (a0c4d44)

v4.10.0

Compare Source

🧾 Release notes

Chores

v4.9.0

Compare Source

🧾 Release notes

Chores

v4.8.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v4.7.0

Compare Source

🧾 Release notes

Chores

v4.6.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v4.5.0

Compare Source

🧾 Release notes

Chores
4.4.1 (2021-06-10)
Chores

v4.4.1

Compare Source

Chores

v4.4.0

Compare Source

🧾 Release notes

Chores

v4.3.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v4.2.0

Compare Source

🧾 Release notes

Bug Fixes
  • Activate footnotes by default & remove included options with remark v13 #​31019 (a35d615)

v4.1.0

Compare Source

🧾 Release notes

Bug Fixes

v4.0.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v3.2.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v3.1.0

Compare Source

🧾 Release notes

Bug Fixes
Refactoring
Chores

v3.0.0

Compare Source

🧾 Release notes

Features
Other Changes
2.16.1 (2021-02-24)

Note: Version bump only for package gatsby-transformer-remark

v2.16.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v2.16.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v2.15.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

v2.14.0

Compare Source

🧾 Release notes

Note: Version bump only for package gatsby-transformer-remark

2.13.1 (2020-12-23)

Note: Version bump only for package gatsby-transformer-remark

v2.13.1

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v2.13.0

Compare Source

🧾 Release notes

Chores

v2.12.0

Compare Source

🧾 Release notes

Bug Fixes
2.11.1 (2020-11-25)
Bug Fixes

v2.11.1

Compare Source

Bug Fixes

v2.11.0

Compare Source

🧾 Release notes

Chores

v2.10.0

Compare Source

🧾 Release notes

Bug Fixes

v2.9.2

Compare Source

v2.9.1

Compare Source

Bug Fixes

v2.9.0

Compare Source

Features

2.8.47 (2020-10-28)

Note: Version bump only for package gatsby-transformer-remark

2.8.46 (2020-10-22)

Note: Version bump only for package gatsby-transformer-remark

2.8.45 (2020-10-21)

Bug Fixes

2.8.44 (2020-10-20)

Performance Improvements
  • implement shouldOnCreateNode for all our plugins/benchmarks (#​27545) (df914d9)

2.8.43 (2020-10-19)

Note: Version bump only for package gatsby-transformer-remark

2.8.42 (2020-10-16)

Performance Improvements

2.8.41 (2020-10-16)

Note: Version bump only for package gatsby-transformer-remark

2.8.40 (2020-10-15)

Note: Version bump only for package gatsby-transformer-remark

2.8.39 (2020-10-14)

Note: Version bump only for package gatsby-transformer-remark

2.8.38 (2020-10-06)

Note: Version bump only for package gatsby-transformer-remark

2.8.37 (2020-10-01)

Note: Version bump only for package gatsby-transformer-remark

2.8.36 (2020-09-28)

Bug Fixes
  • deps: update minor and patch for gatsby-transformer-remark (#​27148) (2cab85a)

2.8.35 (2020-09-15)

Note: Version bump only for package gatsby-transformer-remark

2.8.34 (2020-09-08)

Note: Version bump only for package gatsby-transformer-remark

2.8.33 (2020-09-07)

Note: Version bump only for package gatsby-transformer-remark

2.8.32 (2020-08-31)

Note: Version bump only for package gatsby-transformer-remark

2.8.31 (2020-08-28)

Note: Version bump only for package gatsby-transformer-remark

2.8.30 (2020-08-26)

Note: Version bump only for package gatsby-transformer-remark

2.8.29 (2020-08-24)

Note: Version bump only for package gatsby-transformer-remark

2.8.28 (2020-08-05)

Note: Version bump only for package gatsby-transformer-remark

2.8.27 (2020-07-24)

Note: Version bump only for package gatsby-transformer-remark

2.8.26 (2020-07-21)

Note: Version bump only for package gatsby-transformer-remark

2.8.25 (2020-07-09)

Note: Version bump only for package gatsby-transformer-remark

2.8.24 (2020-07-09)

Note: Version bump only for package gatsby-transformer-remark

2.8.23 (2020-07-02)

Note: Version bump only for package gatsby-transformer-remark

2.8.22 (2020-07-01)

Note: Version bump only for package gatsby-transformer-remark

2.8.21 (2020-07-01)

Note: Version bump only for package gatsby-transformer-remark

2.8.20 (2020-06-29)

Note: Version bump only for package gatsby-transformer-remark

2.8.19 (2020-06-24)

Note: Version bump only for package gatsby-transformer-remark

2.8.18 (2020-06-22)

Note: Version bump only for package gatsby-transformer-remark

2.8.17 (2020-06-19)

Note: Version bump only for package gatsby-transformer-remark

2.8.16 (2020-06-15)

Note: Version bump only for package gatsby-transformer-remark

2.8.15 (2020-06-09)

Note: Version bump only for package gatsby-transformer-remark

2.8.14 (2020-06-02)

Note: Version bump only for package gatsby-transformer-remark

2.8.13 (2020-05-22)

Note: Version bump only for package gatsby-transformer-remark

2.8.12 (2020-05-20)

Note: Version bump only for package gatsby-transformer-remark

2.8.11 (2020-05-20)

Note: Version bump only for package gatsby-transformer-remark

2.8.10 (2020-05-19)

Note: Version bump only for package gatsby-transformer-remark

2.8.9 (2020-05-18)

Note: Version bump only for package gatsby-transformer-remark

2.8.8 (2020-05-13)

Note: Version bump only for package gatsby-transformer-remark

2.8.7 (2020-05-06)

Features
  • gatsby-transform-remark: populate id to headings from markdownAST (#​23546) (464bdb4)

2.8.6 (2020-05-05)

Note: Version bump only for package gatsby-transformer-remark

2.8.5 (2020-05-04)

Note: Version bump only for package gatsby-transformer-remark

2.8.4 (2020-05-01)

Note: Version bump only for package gatsby-transformer-remark

2.8.3 (2020-04-29)

Note: Version bump only for package gatsby-transformer-remark

2.8.1 (2020-04-29)

Note: Version bump only for package gatsby-transformer-remark

v2.8.47

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v2.8.46

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v2.8.45

Compare Source

Bug Fixes

v2.8.44

Compare Source

Performance Improvements
  • implement shouldOnCreateNode for all our plugins/benchmarks (#​27545) (df914d9)

v2.8.43

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v2.8.42

Compare Source

Performance Improvements

v2.8.41

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v2.8.40

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v2.8.39

Compare Source

Note: Version bump only for package gatsby-transformer-remark

v2.8.38

[Compare Source](https://github.com/gatsbyjs/gatsby/compare/57c7


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link

vercel bot commented Jan 11, 2023

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
neontribe-www ❌ Failed (Inspect) Dec 8, 2024 11:07pm

@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from d61cd90 to 2d47671 Compare March 17, 2023 03:45
@renovate
Copy link
Author

renovate bot commented Mar 24, 2023

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

Warning: custom changes will be lost.

@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 2d47671 to 5be34ca Compare May 28, 2023 09:06
@renovate renovate bot changed the title fix(deps): update dependency gatsby-transformer-remark to v5 [security] fix(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed Apr 3, 2024
@renovate renovate bot closed this Apr 3, 2024
@renovate renovate bot deleted the renovate/npm-gatsby-transformer-remark-vulnerability branch April 3, 2024 13:26
@renovate renovate bot changed the title fix(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed fix(deps): update dependency gatsby-transformer-remark to v5 [security] Apr 3, 2024
@renovate renovate bot reopened this Apr 3, 2024
@renovate renovate bot restored the renovate/npm-gatsby-transformer-remark-vulnerability branch April 3, 2024 16:33
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 5be34ca to da40601 Compare April 3, 2024 16:35
@renovate renovate bot changed the base branch from develop to main April 3, 2024 16:36
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from da40601 to 0bf5b2a Compare April 25, 2024 14:48
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 0bf5b2a to 7eec799 Compare April 26, 2024 11:04
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 7eec799 to aa54add Compare May 3, 2024 09:43
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from aa54add to 6bca7cd Compare May 3, 2024 10:51
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 6bca7cd to 98a1bd4 Compare May 24, 2024 09:26
@renovate renovate bot changed the title fix(deps): update dependency gatsby-transformer-remark to v5 [security] Update dependency gatsby-transformer-remark to v5 [SECURITY] May 24, 2024
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 98a1bd4 to 5f41ab0 Compare May 31, 2024 09:26
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 5f41ab0 to baed361 Compare June 5, 2024 13:28
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from baed361 to 39244b4 Compare June 5, 2024 14:44
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 39244b4 to c81a5a9 Compare June 10, 2024 08:53
@renovate renovate bot changed the title Update dependency gatsby-transformer-remark to v5 [SECURITY] fix(deps): update dependency gatsby-transformer-remark to v5 [security] Jun 10, 2024
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from c81a5a9 to 4ceea4c Compare June 10, 2024 09:50
@renovate renovate bot changed the title fix(deps): update dependency gatsby-transformer-remark to v5 [security] Update dependency gatsby-transformer-remark to v5 [SECURITY] Jun 10, 2024
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 4ceea4c to ff46338 Compare July 5, 2024 14:38
@renovate renovate bot changed the title Update dependency gatsby-transformer-remark to v5 [SECURITY] fix(deps): update dependency gatsby-transformer-remark to v5 [security] Jul 5, 2024
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from ff46338 to e7ea5c4 Compare July 24, 2024 09:24
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from e7ea5c4 to 95ac39a Compare August 14, 2024 09:41
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 95ac39a to 4c41ebe Compare September 3, 2024 16:03
@renovate renovate bot force-pushed the renovate/npm-gatsby-transformer-remark-vulnerability branch from 4c41ebe to d12184c Compare September 9, 2024 13:24
@renovate renovate bot changed the title fix(deps): update dependency gatsby-transformer-remark to v5 [security] fix(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed Dec 8, 2024
@renovate renovate bot closed this Dec 8, 2024
@renovate renovate bot deleted the renovate/npm-gatsby-transformer-remark-vulnerability branch December 8, 2024 18:20
@renovate renovate bot changed the title fix(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed fix(deps): update dependency gatsby-transformer-remark to v5 [security] Dec 8, 2024
@renovate renovate bot reopened this Dec 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants