Update dependency containing moderate security flaw

[dialex]

reported at https://www.npmjs.com/advisories/812

[robatwilliams]

Follows discussion started on this issue starting at #122 (comment)

[robatwilliams]

Continuing from the discussion on the unrelated issue...

Sorry 🤦‍♂ ... I didn't remember that the caret works differently below version 1.

I'll try and get round to checking this against some real content and doing a release.

[robatwilliams]

Works fine on our content. AppVeyor problem is something with latest Node 12; ignoring.

[robatwilliams]

Wait until markedjs/marked#1456 fix is released (it was merged yesterday) before doing a release.

There have been many breaking changes (although they are fixes) to marked since the 0.3.5 version that was originally installed in this project. They look safe enough, but it's over 4 years' worth of changes, and I don't have time to deal with any issues they may cause for consumers of this library. I would rather keep the latest version stable, so I'm not doing a release.

Anyone who uses this library to process content that's outside their own control and is concerned about the vulnerability, should be able to use npm audit fix as described here to force-upgrade the transitive dependency (ignore the likely semver warning).

[dialex]

@robatwilliams I see this has been merged to master, yet no release was made in the last 6 months. The latest release (1.3.1) on NPM has 2 years!

Can you please push the latest master to npm, so we can update our packages and solve the vulnerability once and for all?

[robatwilliams]

I'm afraid I don't use this anymore. See my previous comment regarding 4 years' worth of marked changes.

[dialex]

I see. Did the tests fail for this branch? If not, there's not much risk releasing. Still, you could simply release a major version 2.0.0, and highlight it as version with breaking changes:

• Whoever wants to stay behind, fine, they can use 1.3.1.
• Whoever needs to fix security vulnerabilities, we'll take the risk and use 2.0.0.

At least that way we have a choice. What do you think?

[robatwilliams]

I can publish 2.0.0-beta.0 if @lukeapage can give me publishing rights please.