[Snyk] Security upgrade marked from 0.3.5 to 4.0.10

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-2342082	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: marked

• 4.0.10 - 2022-01-13
  

  4.0.10 (2022-01-13)

  Bug Fixes

  • security: fix redos vulnerabilities (8f80657)
• 4.0.9 - 2022-01-06
  

  4.0.9 (2022-01-06)

  Bug Fixes

  • retain line breaks in tokens properly (#2341) (a9696e2)
• 4.0.8 - 2021-12-19
  

  4.0.8 (2021-12-19)

  Bug Fixes

  • spaces on a newline after a table (#2319) (f82ea2c)
• 4.0.7 - 2021-12-09
  

  4.0.7 (2021-12-09)

  Bug Fixes

  • Fix every third list item broken (#2318) (346b162), closes #2314
• 4.0.6 - 2021-12-02
  

  4.0.6 (2021-12-02)

  Bug Fixes

  • speed up parsing long lists (#2302) (e0005d8)
• 4.0.5 - 2021-11-25
  

  4.0.5 (2021-11-25)

  Bug Fixes

  • table after paragraph without blank line (#2298) (5714212)
• 4.0.4 - 2021-11-19
  

  4.0.4 (2021-11-19)

  Bug Fixes

  • fix cli (#2294) (ab2977a)
• 4.0.3 - 2021-11-13
  

  4.0.3 (2021-11-13)

  Bug Fixes

  • build min from umd (#2283) (ea26ea9)
• 4.0.2 - 2021-11-12
  

  4.0.2 (2021-11-12)

  Bug Fixes

  • Create separate CJS and UMD builds (#2281) (62faaf4)
• 4.0.1 - 2021-11-11
  

  4.0.1 (2021-11-11)

  Bug Fixes

  • Set commonJS code as main in package.json (#2276) (7e636d5)
• 4.0.0 - 2021-11-02
• 3.0.8 - 2021-10-24
• 3.0.7 - 2021-10-07
• 3.0.6 - 2021-10-06
• 3.0.5 - 2021-10-06
• 3.0.4 - 2021-09-14
• 3.0.3 - 2021-09-08
• 3.0.2 - 2021-08-25
• 3.0.1 - 2021-08-23
• 3.0.0 - 2021-08-16
• 2.1.3 - 2021-06-25
• 2.1.2 - 2021-06-22
• 2.1.1 - 2021-06-16
• 2.1.0 - 2021-06-15
• 2.0.7 - 2021-06-01
• 2.0.6 - 2021-05-27
• 2.0.5 - 2021-05-21
• 2.0.4 - 2021-05-20
• 2.0.3 - 2021-04-11
• 2.0.2 - 2021-04-10
• 2.0.1 - 2021-02-27
• 2.0.0 - 2021-02-07
• 1.2.9 - 2021-02-03
• 1.2.8 - 2021-01-26
• 1.2.7 - 2020-12-15
• 1.2.6 - 2020-12-10
• 1.2.5 - 2020-11-19
• 1.2.4 - 2020-11-15
• 1.2.3 - 2020-11-04
• 1.2.2 - 2020-10-21
• 1.2.1 - 2020-10-21
• 1.2.0 - 2020-09-28
• 1.1.2 - 2020-10-21
• 1.1.1 - 2020-07-14
• 1.1.0 - 2020-05-16
• 1.0.0 - 2020-04-21
• 0.8.2 - 2020-03-22
• 0.8.1 - 2020-03-18
• 0.8.0 - 2019-12-12
• 0.7.0 - 2019-07-06
• 0.6.3 - 2019-06-30
• 0.6.2 - 2019-04-05
• 0.6.1 - 2019-02-19
• 0.6.0 - 2019-01-01
• 0.5.2 - 2018-11-20
• 0.5.1 - 2018-09-26
• 0.5.0 - 2018-08-16
• 0.4.0 - 2018-05-21
• 0.3.19 - 2018-03-26
• 0.3.18 - 2018-03-22
• 0.3.17 - 2018-02-27
• 0.3.16 - 2018-02-20
• 0.3.15 - 2018-02-19
• 0.3.14 - 2018-02-16
• 0.3.13 - 2018-02-16
• 0.3.12 - 2018-01-09
• 0.3.9 - 2017-12-23
• 0.3.7 - 2017-12-01
• 0.3.6 - 2016-07-30
• 0.3.5 - 2015-07-31

from marked GitHub release notes

Commit messages

Package name: marked

The new version differs by 250 commits.

• ae01170 chore(release): 4.0.10 [skip ci]
• fceda57 🗜️ build [skip ci]
• 8f80657 fix(security): fix redos vulnerabilities
• c4a3ccd Merge pull request from GHSA-rrrm-qjm4-v8hf
• d7212a6 chore(deps-dev): Bump jasmine from 4.0.0 to 4.0.1 (#2352)
• 5a84db5 chore(deps-dev): Bump rollup from 2.62.0 to 2.63.0 (#2350)
• 2bc67a5 chore(deps-dev): Bump markdown-it from 12.3.0 to 12.3.2 (#2351)
• 98996b8 chore(deps-dev): Bump @ babel/preset-env from 7.16.5 to 7.16.7 (#2353)
• ebc2c95 chore(deps-dev): Bump highlight.js from 11.3.1 to 11.4.0 (#2354)
• e5171a9 chore(release): 4.0.9 [skip ci]
• 41990a5 🗜️ build [skip ci]
• a9696e2 fix: retain line breaks in tokens properly (#2341)
• 6aacd13 chore(deps-dev): Bump jasmine from 3.10.0 to 4.0.0 (#2343)
• 55e5df9 chore(deps-dev): Bump @ babel/core from 7.16.5 to 7.16.7 (#2344)
• 4f4cab4 chore(deps-dev): Bump eslint-plugin-import from 2.25.3 to 2.25.4 (#2345)
• 97ea9f2 chore(deps-dev): Bump eslint from 8.5.0 to 8.6.0 (#2346)
• 4c3b853 chore(deps-dev): Bump rollup-plugin-license from 2.6.0 to 2.6.1 (#2347)
• 9396896 chore(deps-dev): Bump rollup from 2.61.1 to 2.62.0 (#2338)
• 103a56c chore(deps-dev): Bump @ babel/preset-env from 7.16.4 to 7.16.5 (#2333)
• be771c9 chore(deps-dev): Bump eslint from 8.4.1 to 8.5.0 (#2334)
• 67d5a65 chore(deps-dev): Bump @ babel/core from 7.16.0 to 7.16.5 (#2335)
• 991493a chore(deps-dev): Bump eslint-plugin-promise from 5.2.0 to 6.0.0 (#2336)
• 59375fb chore(release): 4.0.8 [skip ci]
• 4734c82 🗜️ build [skip ci]

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)