[Snyk] Security upgrade marked from 0.3.5 to 0.4.0

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKED-451540	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: marked

• 0.4.0 - 2018-05-21
  

  Security Fixes

  • Fix unsafe heading regex (#1224)
  • Fix unsafe link regex (#1223, #1227)

  New Features

  • Add option to disable heading ids (#1190)
  • Add support for GFM Task Lists to comply with the GFM spec (#1250)

  Breaking Changes

  • Fix escaping pipes in tables (#1239)
  • Fix html output for tables to match GFM spec (#1245)
  • Fix many bugs to reach parity with CommonMark spec (#1135)
  • Fix new Renderer() so it uses default options (#1203)
  • Fix text and paragraph return types (#1248) (#1249)
  • Fix <em> less than 3 chars (#1181)
  • Fix <pre> code blocks so there is no more trailing \n (#1266)
  • Fix default langPrefix to follow CommonMark standard language- (#1265)

  CLI Changes

  • Add string argument to CLI (#1182)
  • Change CLI stdio to remove warning (#994)

  Other changes

  • Lint all the things (#1185)
  • Improved testing and DevOps (#1160, #1210, #1220, #1228, #1219, #1256)
  • Update documentation and demos (#1196, #1197, #1204, #1207, #1221, #1233, #1217, #1240, #1244, #1253)
• 0.3.19 - 2018-03-26
  

  0.3.18 did not have changes to min.

• 0.3.18 - 2018-03-22
  
  • Supported Markdown flavors: CommonMark 0.28 and GitHub Flavored Markdown 0.28
  • Updates to our CI pipeline; we're all green! #1098 with the caveat that there is a test that needs to get sorted (help us out #1092)
  • Start ordered lists using the initial numbers from markdown lists (#1144)
  • Added GitHub Pages site for documentation https://marked.js.org/ (#1138)
• 0.3.17 - 2018-02-27
  
  • The elephant in the room: A security vulnerability was discovered and fixed. Please note, if something breaks due to these changes, it was not our intent, and please let us know by submitting a PR or issue to course correct (the nature of the zero-major release and having security as a number one priority) #1083
  • The other elephant in the room: We missed publishing a 0.3.16 release to GitHub; so, trying to make up for that a bit.
  • Updates to the project documentation and operations, you should check it out, just start with the README and you should be good.
  • New release PR template available #1076
  • Updates to default PR and Issue templates #1076
  • Lint checks + tests + continuous integration using Travis #1020
  • Updated testing output #1085 & #1087
• 0.3.16 - 2018-02-20
• 0.3.15 - 2018-02-19
  

  Fixes unintended breaking change from v0.3.14

• 0.3.14 - 2018-02-16
  
  • Marked has a new home under the MarkedJS org! Other advances soon to come.
  • Updated minifier.
  • Various parser fixes
• 0.3.13 - 2018-02-16
• 0.3.12 - 2018-01-09
  
  • Addresses issue where some users might not have been able to update due to missing use strict #991
  • Parser fix #977
  • New way to perform tests with options and running individual tests #1002
  • Improved test cases
  • Improved links
• 0.3.9 - 2017-12-23
  

  We think with this version we have addressed most, if not all, known security vulnerabilities. If you find more, please let us know.

• 0.3.7 - 2017-12-01
  

  Should fix XSS issue discovered.

• 0.3.6 - 2016-07-30
  

  v0.3.6

• 0.3.5 - 2015-07-31

from marked GitHub release notes

Commit messages

Package name: marked

The new version differs by 250 commits.

• 78db8fb Merge pull request #1273 from 8fold/release-0.4.0
• 30a80e2 0.4.0
• 3957460 Merge pull request #1251 from markedjs/issue-templates
• dd10e47 🗜️ minify [skip ci]
• 0bc2fc5 Merge pull request #1265 from remyrylan/master
• 0218945 Merge pull request #1266 from remyrylan/remove-extra-linebreak
• 6ab2593 Remove extra inner linebreak from code blocks
• 7b1d0be Update fenced code blocks to CommonMark standard
• 4e910c3 Add a "why" to feature request
• 0a247fe Create Proposal.md
• 63d1a45 Change desc of feature request
• cdd596f Update bug description
• 0c8ff4b Remove unnecessary sections
• 579f7bf 🗜️ minify [skip ci]
• 42c3915 Merge pull request #1250 from tomtheisen/gfm-tasks
• 367604e Add links to demo
• c59e4a1 Update issue templates
• e0434b1 Merge pull request #1253 from Martii/patch-1
• 547ffb8 🗜️ minify [skip ci]
• dbd0dff Merge pull request #1256 from UziTech/test-travis
• 9b1c6aa move security scan to the end
• b151864 fast_finish
• 19832b4 allow redos test to fail
• fab3ee2 Merge pull request #994 from Feder1co5oave/fixes_992

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)