mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2025-02-22 19:35:47 -05:00
faa263d54a
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [katex](https://katex.org) ([source](https://github.com/KaTeX/KaTeX)) | dependencies | patch | [`0.16.18` -> `0.16.21`](https://renovatebot.com/diffs/npm/katex/0.16.18/0.16.21) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### KaTeX \htmlData does not validate attribute names [CVE-2025-23207](https://nvd.nist.gov/vuln/detail/CVE-2025-23207) / [GHSA-cg87-wmx4-v546](https://github.com/advisories/GHSA-cg87-wmx4-v546) <details> <summary>More information</summary> #### Details ##### Impact KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. ##### Patches Upgrade to KaTeX v0.16.21 to remove this vulnerability. ##### Workarounds - Avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands. - Forbid inputs containing the substring `"\\htmlData"`. - Sanitize HTML output from KaTeX. ##### Details `\htmlData` did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts. ##### For more information If you have any questions or comments about this advisory: - Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/) - Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu) #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L` #### References - [https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546](https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546) - [https://nvd.nist.gov/vuln/detail/CVE-2025-23207](https://nvd.nist.gov/vuln/detail/CVE-2025-23207) - [ff289955e8) - [https://github.com/KaTeX/KaTeX](https://github.com/KaTeX/KaTeX) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-cg87-wmx4-v546) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>KaTeX/KaTeX (katex)</summary> ### [`v0.16.21`](https://github.com/KaTeX/KaTeX/blob/HEAD/CHANGELOG.md#01621-2025-01-17) [Compare Source](https://github.com/KaTeX/KaTeX/compare/v0.16.20...v0.16.21) ##### Bug Fixes - escape \htmlData attribute name ([57914ad](57914ad91e)) ### [`v0.16.20`](https://github.com/KaTeX/KaTeX/blob/HEAD/CHANGELOG.md#01620-2025-01-12) [Compare Source](https://github.com/KaTeX/KaTeX/compare/v0.16.19...v0.16.20) ##### Bug Fixes - \providecommand does not overwrite existing macro ([#​4000](https://github.com/KaTeX/KaTeX/issues/4000)) ([6d30fe4](6d30fe47b0)), closes [#​3928](https://github.com/KaTeX/KaTeX/issues/3928) ### [`v0.16.19`](https://github.com/KaTeX/KaTeX/blob/HEAD/CHANGELOG.md#01619-2024-12-29) [Compare Source](https://github.com/KaTeX/KaTeX/compare/v0.16.18...v0.16.19) ##### Bug Fixes - **types:** improve `strict` function type ([#​4009](https://github.com/KaTeX/KaTeX/issues/4009)) ([4228b4e](4228b4eb52)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - "* 0-3 * * *" (UTC). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xMzYuMCIsInVwZGF0ZWRJblZlciI6IjM5LjEzNi4xIiwidGFyZ2V0QnJhbmNoIjoidjEwLjAvZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6694 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org> Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
105 lines
3.3 KiB
JSON
105 lines
3.3 KiB
JSON
{
|
|
"type": "module",
|
|
"engines": {
|
|
"node": ">= 18.0.0"
|
|
},
|
|
"dependencies": {
|
|
"@citation-js/core": "0.7.14",
|
|
"@citation-js/plugin-bibtex": "0.7.16",
|
|
"@citation-js/plugin-software-formats": "0.6.1",
|
|
"@github/markdown-toolbar-element": "2.2.3",
|
|
"@github/quote-selection": "2.1.0",
|
|
"@github/relative-time-element": "4.4.4",
|
|
"@github/text-expander-element": "2.8.0",
|
|
"@mcaptcha/vanilla-glue": "0.1.0-alpha-3",
|
|
"@primer/octicons": "19.14.0",
|
|
"ansi_up": "6.0.2",
|
|
"asciinema-player": "3.8.0",
|
|
"chart.js": "4.4.5",
|
|
"chartjs-adapter-dayjs-4": "1.0.4",
|
|
"chartjs-plugin-zoom": "2.2.0",
|
|
"clippie": "4.1.1",
|
|
"css-loader": "7.0.0",
|
|
"dayjs": "1.11.12",
|
|
"dropzone": "6.0.0-beta.2",
|
|
"easymde": "2.18.0",
|
|
"esbuild-loader": "4.2.2",
|
|
"escape-goat": "4.0.0",
|
|
"fast-glob": "3.3.2",
|
|
"htmx.org": "1.9.12",
|
|
"idiomorph": "0.3.0",
|
|
"jquery": "3.7.1",
|
|
"katex": "0.16.21",
|
|
"mermaid": "11.4.1",
|
|
"mini-css-extract-plugin": "2.9.2",
|
|
"minimatch": "10.0.1",
|
|
"monaco-editor": "0.51.0",
|
|
"monaco-editor-webpack-plugin": "7.1.0",
|
|
"pdfobject": "2.3.0",
|
|
"postcss": "8.4.49",
|
|
"postcss-loader": "8.1.1",
|
|
"postcss-nesting": "13.0.1",
|
|
"pretty-ms": "9.0.0",
|
|
"sortablejs": "1.15.6",
|
|
"swagger-ui-dist": "5.17.14",
|
|
"tailwindcss": "3.4.17",
|
|
"throttle-debounce": "5.0.0",
|
|
"tinycolor2": "1.6.0",
|
|
"tippy.js": "6.3.7",
|
|
"toastify-js": "1.12.0",
|
|
"tributejs": "5.1.3",
|
|
"uint8-to-base64": "0.2.0",
|
|
"vanilla-colorful": "0.7.2",
|
|
"vue": "3.5.13",
|
|
"vue-chartjs": "5.3.1",
|
|
"vue-loader": "17.4.2",
|
|
"vue3-calendar-heatmap": "2.0.5",
|
|
"webpack": "5.97.1",
|
|
"webpack-cli": "6.0.1",
|
|
"wrap-ansi": "9.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@axe-core/playwright": "4.10.1",
|
|
"@eslint-community/eslint-plugin-eslint-comments": "4.4.1",
|
|
"@playwright/test": "1.49.1",
|
|
"@stoplight/spectral-cli": "6.14.2",
|
|
"@stylistic/eslint-plugin-js": "2.12.1",
|
|
"@stylistic/stylelint-plugin": "3.1.1",
|
|
"@typescript-eslint/parser": "8.18.2",
|
|
"@vitejs/plugin-vue": "5.1.5",
|
|
"@vitest/coverage-v8": "2.1.8",
|
|
"@vitest/eslint-plugin": "1.1.20",
|
|
"@vue/test-utils": "2.4.6",
|
|
"eslint": "9.17.0",
|
|
"eslint-import-resolver-typescript": "3.7.0",
|
|
"eslint-plugin-array-func": "5.0.2",
|
|
"eslint-plugin-import-x": "4.6.1",
|
|
"eslint-plugin-no-jquery": "3.1.0",
|
|
"eslint-plugin-no-use-extend-native": "0.7.2",
|
|
"eslint-plugin-playwright": "2.1.0",
|
|
"eslint-plugin-regexp": "2.7.0",
|
|
"eslint-plugin-sonarjs": "3.0.1",
|
|
"eslint-plugin-unicorn": "56.0.1",
|
|
"eslint-plugin-vitest-globals": "1.5.0",
|
|
"eslint-plugin-vue": "9.32.0",
|
|
"eslint-plugin-vue-scoped-css": "2.9.0",
|
|
"eslint-plugin-wc": "2.2.0",
|
|
"globals": "15.14.0",
|
|
"happy-dom": "15.11.7",
|
|
"license-checker-rseidelsohn": "4.4.2",
|
|
"markdownlint-cli": "0.43.0",
|
|
"postcss-html": "1.7.0",
|
|
"stylelint": "16.12.0",
|
|
"stylelint-declaration-block-no-ignored-properties": "2.8.0",
|
|
"stylelint-declaration-strict-value": "1.10.6",
|
|
"stylelint-value-no-unknown-custom-properties": "6.0.1",
|
|
"svgo": "3.2.0",
|
|
"typescript": "5.7.2",
|
|
"typescript-eslint": "8.18.2",
|
|
"vite-string-plugin": "1.3.4",
|
|
"vitest": "2.1.8"
|
|
},
|
|
"browserslist": [
|
|
"defaults"
|
|
]
|
|
}
|