Skip to content

fix(deps): resolve 7 Dependabot alerts (commonmark 2.10.0, nanoid 3.3.18) - #262

Merged
dan2k3k4 merged 1 commit into
devfrom
fix/dependabot-commonmark-nanoid
Aug 19, 2026
Merged

fix(deps): resolve 7 Dependabot alerts (commonmark 2.10.0, nanoid 3.3.18)#262
dan2k3k4 merged 1 commit into
devfrom
fix/dependabot-commonmark-nanoid

Conversation

@dan2k3k4

Copy link
Copy Markdown
Member

Resolves all 7 open Dependabot alerts:

  • league/commonmark 2.8.3 → 2.10.0 — fixes 6 alerts (5 DoS vectors in Markdown parsing/rendering, 1 unsafe-link filter bypass via control bytes). All patched in 2.9.0; 2.10.0 is the current release.
  • nanoid 3.3.16 → 3.3.18 — fixes infinite loop with zero-size custom generators (transitive npm dev dependency).

Lockfile-only changes. Full Pest suite passes (579 tests) and npm run build succeeds.

@dan2k3k4
dan2k3k4 marked this pull request as ready for review August 19, 2026 07:25
@dan2k3k4
dan2k3k4 merged commit f7b672b into dev Aug 19, 2026
4 checks passed
@dan2k3k4
dan2k3k4 deleted the fix/dependabot-commonmark-nanoid branch August 19, 2026 07:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant