Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency autolinker to v3 #10

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

mend-for-github-com[bot]
Copy link

@mend-for-github-com mend-for-github-com bot commented Feb 29, 2024

This PR contains the following updates:

Package Type Update Change
autolinker dependencies major 0.24.1 -> 3.14.0

By merging this PR, the issue #1 will be automatically resolved and closed:

Severity CVSS Score CVE Reachability
Medium Medium 6.1 WS-2017-3770
Medium Medium 5.3 WS-2019-0540

Release Notes

gregjacobs/Autolinker.js (autolinker)

v3.14.0

Compare Source

  • Added sanitizeHtml option for basic XSS sanitization (thanks @​adi928)

v3.13.0

Compare Source

v3.12.0

Compare Source

v3.11.1

Compare Source

Narrow down the emoji regex to not include things like curly quotes (thanks @​adamdavidcole!)

v3.11.0

Some amazing contributions in this release. Sorry for the version number snafu - accidentally created a 3.10.0 tag instead of 3.1.0, so went up from there.

Changes:

v3.0.5

Compare Source

v3.0.4

Compare Source

  • Export all Autolinker config interfaces from index.ts

v3.0.3

Compare Source

  • Fix name of package in bower.json to be lowercase

v3.0.2

Compare Source

  • Fix issue where closing square brackets could be included in a URL when the URL was simply wrapped in square brackets (#​228)

v3.0.1

Compare Source

Fix issue with unquoted html attributes not parsing as html tags (#​263)

v3.0.0: v.3.0.0

Compare Source

Main Changes:

  • Replaced the RegExp-based HTML Parser and EmailMatcher with linear-time state machine parsers (PRs #​259 and #​260). Closes #​257, and improves performance across the board, especially with large strings

Breaking Changes:

  • Removed HtmlParser class, replacing with an internal parseHtml() function

v2.2.2

Compare Source

Use tslib dependency to remove duplicate __extends function in minified file. Saves 3kb

v2.2.1

Compare Source

  • Increase Twitter mention length from 20 to 50 characters (Twitter usernames may now be 50 characters)
  • Fix issue with mentions and hashtags where partial mentions/hashtags could be linked if they were above the prescribed number of allowed characters

v2.2.0

Compare Source

  • Allow unicode combining marks in URLs

v2.1.0

Compare Source

  • Re-add getPhoneNumber() method to PhoneMatch. This method name is a bit more clear than getNumber(). Left getNumber() for backward compatibility

v2.0.0

Compare Source

  • Convert codebase to TypeScript
  • Add type declaration files to output
  • Add commonjs / es2015 output in addition to the UMD output from v1.x
  • Allow Autolinker to be imported using the ES6 import keyword, as well as other entities like Matcher, Match, etc.
  • Allow Autolinker to work within webpack without any shimming
  • Fix issue with minification of unicode escape sequences used in regular expression character classes
  • Upgrade gulp from v3 to v4
  • Update TLD regex
  • Add integration tests for loading with Node.js's require(), ES6/TypeScript import, UMD output file in browsers, and Webpack
  • Move live example to root-level folder
  • Add test to make sure the live example is working

Closes #​254

v1.8.3

Compare Source

  • skip parsing the contents of <style> and <script> tags (thanks @​examan!)

v1.8.1

Compare Source

Re-add dist/ folder for bower compatibility

v1.8.0

Compare Source

Add support for soundcloud mentions (thanks @​Superjo149)

v1.7.1

Compare Source

  • Fix for compactMatches() to correctly handle matches that are directly next to each other. Thanks @​bgryszko!

v1.7.0

Compare Source

  • Add support for non-US phone numbers when prefixed with a plus sign. Thanks @​oladon!

v1.6.2

Compare Source

  • Improve regex performance for URL parsing (i.e. fix another case of potential catastrophic backtracking). Thanks @​caseywebdev!

v1.6.1

Compare Source

v1.6.0

Compare Source

  • Add decodePercentEncoding option (thanks @​c960657!)

v1.5.0

Compare Source

v1.4.4

Compare Source

  • Change domain regex to not match domains with leading - or . characters

Thanks @​viman !

v1.4.3

Compare Source

  • Fixes #​207 where an email was matched as an URL

Thanks @​kbs0327 !

v1.4.2

Compare Source

  • We now support IDN and punicode TLDs
  • TLD list can now be updated with gulp update-tld-list

Thanks @​tsx !

v1.4.1

Compare Source

v1.4.0

Compare Source

  • Use the HTML &hellip; entity instead of .. for ellipsis
  • Add a title attribute with the full URL on anchor tags that have had their text truncated

Thanks @​olafleur for both of these changes!

v1.3.4

Compare Source

  • No changes from 1.3.2. Accidentally pushed a tag named 1.3.3 for the 1.3.1 version, so created a new version to be greater than the accidental tag

v1.3.2

Compare Source

  • Support local urls with numbers (such as http://localhost.local001/test). Thanks @​olafleur!

v1.3.1

Compare Source

  • Fix for Array.prototype.push encountering a "Maximum Call Stack Exceeded" error when the input is a large number of HTML character entities

v1.3.0

Compare Source

  • Fix ReDos issue for input that resembled html but wasn't (#​172)

v1.2.2

Compare Source

  • Fix issue with possibly autolinking a domain name with multiple consecutive dots (Thanks @​olafleur!)

v1.2.1

Compare Source

Move gulp-header dependency from dependencies to devDependencies

v1.2.0

Compare Source

  • Add static parse() method as a convenience for the instance-level parse() method

v1.1.1

Compare Source

v1.1.0

Compare Source

  • Add stripTrailingSlash option to decided whether or not to remove a trailing slash from URL matches
  • Add individual scheme and www options to stripPrefix to decide to strip the scheme, the 'www', or both from URL matches

v1.0.0

Compare Source

Long awaited 1.0 release which adds the mention feature to replace the twitter option, and change the replaceFn to be passed only one argument (the Match object).

Breaking Changes from 0.x -> 1.x

  1. twitter option removed, replaced with mention (which accepts 'twitter'
    and 'instagram' values)
  2. Matching mentions (previously the twitter option) now defaults to
    being turned off. Previously, Twitter handle matching was on by
    default.
  3. replaceFn option now called with just one argument: the Match
    object (previously was called with two arguments: autolinker and
    match)
  4. (Used inside the replaceFn) TwitterMatch replaced with
    MentionMatch, and MentionMatch.getType() now returns 'mention'
    instead of 'twitter'
  5. (Used inside the replaceFn) TwitterMatch.getTwitterHandle() ->
    MentionMatch.getMention()

v0.28.1

Compare Source

  • Fix for IP address linking which could possibly link an invalid IP address. Thanks @​olafleur!

v0.28.0

Compare Source

  • Add support for autolinking IP addresses which start with a protocol. Thanks @​olafleur!

v0.27.0

Compare Source

  • Fixed an issue where an input string that contained a < that didn't begin an HTML tag could cause Chrome to hang in an infinite loop in certain situations

v0.26.1

Compare Source

  • Fix to allow underscores in email addresses (thanks @​enahum)
  • Fix to allow apostrophes in email addresses (thanks @​dmatteo)

v0.26.0

Compare Source

v0.25.2

Compare Source

  • Add version property to Autolinker
  • Don't truncate the string when the truncate length is 0

v0.25.1

Compare Source

v0.25.0

Compare Source

  • Add Match.buildTag() method as a shorthand for Autolinker.getTagBuilder().build( match ). Fixes #​143
  • Remove use of ES5 Array.prototype.filer() function, to maintain compatibility with IE8. Fixes #​144

  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by Mend label Feb 29, 2024
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/autolinker-3.x branch from 6809dee to 3fc90ba Compare March 21, 2024 09:40
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/autolinker-3.x branch from 3fc90ba to 5c58555 Compare April 9, 2024 09:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security fix Security fix generated by Mend
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants