-
Notifications
You must be signed in to change notification settings - Fork 5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(deps): update dependency gatsby-transformer-remark to v5 [security] #588
Open
renovate
wants to merge
1
commit into
main
Choose a base branch
from
renovate/npm-gatsby-transformer-remark-vulnerability
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
fix(deps): update dependency gatsby-transformer-remark to v5 [security] #588
renovate
wants to merge
1
commit into
main
from
renovate/npm-gatsby-transformer-remark-vulnerability
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
March 17, 2023 03:45
d61cd90
to
2d47671
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠ Warning: custom changes will be lost. |
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
May 28, 2023 09:06
2d47671
to
5be34ca
Compare
renovate
bot
changed the title
fix(deps): update dependency gatsby-transformer-remark to v5 [security]
fix(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed
Apr 3, 2024
renovate
bot
deleted the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
April 3, 2024 13:26
renovate
bot
changed the title
fix(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed
fix(deps): update dependency gatsby-transformer-remark to v5 [security]
Apr 3, 2024
renovate
bot
restored the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
April 3, 2024 16:33
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
April 3, 2024 16:35
5be34ca
to
da40601
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
April 25, 2024 14:48
da40601
to
0bf5b2a
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
April 26, 2024 11:04
0bf5b2a
to
7eec799
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
May 3, 2024 09:43
7eec799
to
aa54add
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
May 3, 2024 10:51
aa54add
to
6bca7cd
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
May 24, 2024 09:26
6bca7cd
to
98a1bd4
Compare
renovate
bot
changed the title
fix(deps): update dependency gatsby-transformer-remark to v5 [security]
Update dependency gatsby-transformer-remark to v5 [SECURITY]
May 24, 2024
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
May 31, 2024 09:26
98a1bd4
to
5f41ab0
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
June 5, 2024 13:28
5f41ab0
to
baed361
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
June 5, 2024 14:44
baed361
to
39244b4
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
June 10, 2024 08:53
39244b4
to
c81a5a9
Compare
renovate
bot
changed the title
Update dependency gatsby-transformer-remark to v5 [SECURITY]
fix(deps): update dependency gatsby-transformer-remark to v5 [security]
Jun 10, 2024
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
June 10, 2024 09:50
c81a5a9
to
4ceea4c
Compare
renovate
bot
changed the title
fix(deps): update dependency gatsby-transformer-remark to v5 [security]
Update dependency gatsby-transformer-remark to v5 [SECURITY]
Jun 10, 2024
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
July 5, 2024 14:38
4ceea4c
to
ff46338
Compare
renovate
bot
changed the title
Update dependency gatsby-transformer-remark to v5 [SECURITY]
fix(deps): update dependency gatsby-transformer-remark to v5 [security]
Jul 5, 2024
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
July 24, 2024 09:24
ff46338
to
e7ea5c4
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
August 14, 2024 09:41
e7ea5c4
to
95ac39a
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
September 3, 2024 16:03
95ac39a
to
4c41ebe
Compare
renovate
bot
force-pushed
the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
from
September 9, 2024 13:24
4c41ebe
to
d12184c
Compare
renovate
bot
changed the title
fix(deps): update dependency gatsby-transformer-remark to v5 [security]
fix(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed
Dec 8, 2024
renovate
bot
deleted the
renovate/npm-gatsby-transformer-remark-vulnerability
branch
December 8, 2024 18:20
renovate
bot
changed the title
fix(deps): update dependency gatsby-transformer-remark to v5 [security] - autoclosed
fix(deps): update dependency gatsby-transformer-remark to v5 [security]
Dec 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.8.19
->5.25.1
GitHub Vulnerability Alerts
CVE-2023-22491
Impact
The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the
gray-matter
npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL). Injected JavaScript executes in the context of the build server.To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark. The following payload demonstrates a vulnerable configuration:
Patches
A patch has been introduced in
[email protected]
and[email protected]
which mitigates the issue by disabling thegray-matter
JavaScript Frontmatter engine. The patch introduces a new option,JSFrontmatterEngine
which is set tofalse
by default. When settingJSFrontmatterEngine
totrue
, input passed togatsby-plugin-mdx
must be sanitized before processing to avoid a security risk. Warnings are displayed when enablingJSFrontmatterEngine
totrue
or if it appears that the MarkdownRemark input is attempting to use the Frontmatter engine.Workarounds
If an older version of
gatsby-transformer-remark
must be used, input passed into the plugin should be sanitized ahead of processing.We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.
For more information
Email us at [email protected].
Release Notes
gatsbyjs/gatsby (gatsby-transformer-remark)
v5.25.1
Compare Source
v5.25.0
Compare Source
v5.24.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
5.23.1 (2022-09-22)
Note: Version bump only for package gatsby-transformer-remark
v5.23.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.23.0
Compare Source
🧾 Release notes
Chores
v5.22.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.21.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.20.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.19.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
5.18.1 (2022-07-12)
Note: Version bump only for package gatsby-transformer-remark
v5.18.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.18.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.17.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.16.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
5.15.1 (2022-06-01)
Note: Version bump only for package gatsby-transformer-remark
v5.15.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.15.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.14.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.13.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
5.12.1 (2022-04-13)
Note: Version bump only for package gatsby-transformer-remark
v5.12.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.12.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
5.11.1 (2022-03-31)
Note: Version bump only for package gatsby-transformer-remark
v5.11.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.11.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
5.10.2 (2022-03-23)
Note: Version bump only for package gatsby-transformer-remark
5.10.1 (2022-03-18)
Note: Version bump only for package gatsby-transformer-remark
v5.10.2
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.10.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.10.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
5.9.1 (2022-03-09)
Note: Version bump only for package gatsby-transformer-remark
v5.9.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.9.0
Compare Source
🧾 Release notes
Chores
5.8.2 (2022-03-01)
Note: Version bump only for package gatsby-transformer-remark
5.8.1 (2022-02-25)
Note: Version bump only for package gatsby-transformer-remark
v5.8.2
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.8.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.8.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.7.0
Compare Source
🧾 Release notes
Bug Fixes
v5.6.0
Compare Source
🧾 Release notes
Bug Fixes
5.5.2 (2022-01-17)
Note: Version bump only for package gatsby-transformer-remark
5.5.1 (2022-01-12)
Note: Version bump only for package gatsby-transformer-remark
v5.5.2
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.5.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.5.0
Compare Source
🧾 Release notes
Chores
v5.4.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.3.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v5.2.0
Compare Source
🧾 Release notes
Bug Fixes
5.1.4 (2021-11-15)
Note: Version bump only for package gatsby-transformer-remark
5.1.3 (2021-11-11)
Note: Version bump only for package gatsby-transformer-remark
5.1.2 (2021-11-10)
Note: Version bump only for package gatsby-transformer-remark
5.1.1 (2021-11-09)
Bug Fixes
v5.1.4
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.1.3
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.1.2
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v5.1.1
Compare Source
Bug Fixes
v5.1.0
Compare Source
🧾 Release notes
Bug Fixes
v5.0.0
Compare Source
🧾 Release notes
Features
Chores
Other Changes
v4.12.0
Compare Source
v4.11.0
Compare Source
🧾 Release notes
Features
Chores
Other Changes
v4.10.0
Compare Source
🧾 Release notes
Chores
v4.9.0
Compare Source
🧾 Release notes
Chores
v4.8.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v4.7.0
Compare Source
🧾 Release notes
Chores
v4.6.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v4.5.0
Compare Source
🧾 Release notes
Chores
4.4.1 (2021-06-10)
Chores
v4.4.1
Compare Source
Chores
v4.4.0
Compare Source
🧾 Release notes
Chores
v4.3.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v4.2.0
Compare Source
🧾 Release notes
Bug Fixes
v4.1.0
Compare Source
🧾 Release notes
Bug Fixes
v4.0.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v3.2.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v3.1.0
Compare Source
🧾 Release notes
Bug Fixes
Refactoring
Chores
v3.0.0
Compare Source
🧾 Release notes
Features
Other Changes
2.16.1 (2021-02-24)
Note: Version bump only for package gatsby-transformer-remark
v2.16.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v2.16.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v2.15.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
v2.14.0
Compare Source
🧾 Release notes
Note: Version bump only for package gatsby-transformer-remark
2.13.1 (2020-12-23)
Note: Version bump only for package gatsby-transformer-remark
v2.13.1
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v2.13.0
Compare Source
🧾 Release notes
Chores
v2.12.0
Compare Source
🧾 Release notes
Bug Fixes
getNodesByType()
is passed through #28218 (7867897)2.11.1 (2020-11-25)
Bug Fixes
getNodesByType()
is passed through #28218 #28261 (63e189d)v2.11.1
Compare Source
Bug Fixes
getNodesByType()
is passed through #28218 #28261 (63e189d)v2.11.0
Compare Source
🧾 Release notes
Chores
v2.10.0
Compare Source
🧾 Release notes
Bug Fixes
v2.9.2
Compare Source
v2.9.1
Compare Source
Bug Fixes
v2.9.0
Compare Source
Features
2.8.47 (2020-10-28)
Note: Version bump only for package gatsby-transformer-remark
2.8.46 (2020-10-22)
Note: Version bump only for package gatsby-transformer-remark
2.8.45 (2020-10-21)
Bug Fixes
2.8.44 (2020-10-20)
Performance Improvements
2.8.43 (2020-10-19)
Note: Version bump only for package gatsby-transformer-remark
2.8.42 (2020-10-16)
Performance Improvements
2.8.41 (2020-10-16)
Note: Version bump only for package gatsby-transformer-remark
2.8.40 (2020-10-15)
Note: Version bump only for package gatsby-transformer-remark
2.8.39 (2020-10-14)
Note: Version bump only for package gatsby-transformer-remark
2.8.38 (2020-10-06)
Note: Version bump only for package gatsby-transformer-remark
2.8.37 (2020-10-01)
Note: Version bump only for package gatsby-transformer-remark
2.8.36 (2020-09-28)
Bug Fixes
2.8.35 (2020-09-15)
Note: Version bump only for package gatsby-transformer-remark
2.8.34 (2020-09-08)
Note: Version bump only for package gatsby-transformer-remark
2.8.33 (2020-09-07)
Note: Version bump only for package gatsby-transformer-remark
2.8.32 (2020-08-31)
Note: Version bump only for package gatsby-transformer-remark
2.8.31 (2020-08-28)
Note: Version bump only for package gatsby-transformer-remark
2.8.30 (2020-08-26)
Note: Version bump only for package gatsby-transformer-remark
2.8.29 (2020-08-24)
Note: Version bump only for package gatsby-transformer-remark
2.8.28 (2020-08-05)
Note: Version bump only for package gatsby-transformer-remark
2.8.27 (2020-07-24)
Note: Version bump only for package gatsby-transformer-remark
2.8.26 (2020-07-21)
Note: Version bump only for package gatsby-transformer-remark
2.8.25 (2020-07-09)
Note: Version bump only for package gatsby-transformer-remark
2.8.24 (2020-07-09)
Note: Version bump only for package gatsby-transformer-remark
2.8.23 (2020-07-02)
Note: Version bump only for package gatsby-transformer-remark
2.8.22 (2020-07-01)
Note: Version bump only for package gatsby-transformer-remark
2.8.21 (2020-07-01)
Note: Version bump only for package gatsby-transformer-remark
2.8.20 (2020-06-29)
Note: Version bump only for package gatsby-transformer-remark
2.8.19 (2020-06-24)
Note: Version bump only for package gatsby-transformer-remark
2.8.18 (2020-06-22)
Note: Version bump only for package gatsby-transformer-remark
2.8.17 (2020-06-19)
Note: Version bump only for package gatsby-transformer-remark
2.8.16 (2020-06-15)
Note: Version bump only for package gatsby-transformer-remark
2.8.15 (2020-06-09)
Note: Version bump only for package gatsby-transformer-remark
2.8.14 (2020-06-02)
Note: Version bump only for package gatsby-transformer-remark
2.8.13 (2020-05-22)
Note: Version bump only for package gatsby-transformer-remark
2.8.12 (2020-05-20)
Note: Version bump only for package gatsby-transformer-remark
2.8.11 (2020-05-20)
Note: Version bump only for package gatsby-transformer-remark
2.8.10 (2020-05-19)
Note: Version bump only for package gatsby-transformer-remark
2.8.9 (2020-05-18)
Note: Version bump only for package gatsby-transformer-remark
2.8.8 (2020-05-13)
Note: Version bump only for package gatsby-transformer-remark
2.8.7 (2020-05-06)
Features
2.8.6 (2020-05-05)
Note: Version bump only for package gatsby-transformer-remark
2.8.5 (2020-05-04)
Note: Version bump only for package gatsby-transformer-remark
2.8.4 (2020-05-01)
Note: Version bump only for package gatsby-transformer-remark
2.8.3 (2020-04-29)
Note: Version bump only for package gatsby-transformer-remark
2.8.1 (2020-04-29)
Note: Version bump only for package gatsby-transformer-remark
v2.8.47
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v2.8.46
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v2.8.45
Compare Source
Bug Fixes
v2.8.44
Compare Source
Performance Improvements
v2.8.43
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v2.8.42
Compare Source
Performance Improvements
v2.8.41
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v2.8.40
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v2.8.39
Compare Source
Note: Version bump only for package gatsby-transformer-remark
v2.8.38
[Compare Source](https://github.com/gatsbyjs/gatsby/compare/57c7
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.