Bump marko from 4.18.28 to 5.38.36

[dependabot]

Bumps marko from 4.18.28 to 5.38.36.

Release notes

Sourced from marko's releases.

marko@5.38.36

Patch Changes

• #3159 19d4b37 Thanks @​DylanPiercey! - Fix escaping issue for dynamic text interpolation inside <script>, <style>, <html-script> and <html-style> tags.

  The issue was that the escaping logic for those tags used a CASE SENSITIVE search for the closing tag which could be bypassed like so:

  <script>${"</SCRIPT><img src=x onerror=alert('uh oh')>"}</script>

  Note that script and style there should never render unsanitized user defined values, regardless of wether or not the closing tag is escaped, since these are conceptually just "eval".

• #3159 19d4b37 Thanks @​DylanPiercey! - Fix escaping for <html-comment> tag. Previously this tag relied on normal xml escaping which looks for <. This PR updates to have a special escape for <html-comment> tags that replaces > instead.

  // Previously incorrectly escaped.
  <html-comment>${">Uh oh"}</html-comment>

• Updated dependencies [19d4b37, 19d4b37]:

  • @​marko/runtime-tags@​6.0.164

marko@5.38.35

Patch Changes

• #3145 654fdc2 Thanks @​DylanPiercey! - Improve support for class/tags interop when using legacy renderer apis.

• Updated dependencies [654fdc2]:

  • @​marko/runtime-tags@​6.0.162

marko@5.38.34

Patch Changes

• #3137 d965e38 Thanks @​LuLaValva! - Add types for tag

• Updated dependencies [d965e38, c9d7389]:

  • @​marko/runtime-tags@​6.0.160

marko@5.38.33

Patch Changes

• #3135 ae034a5 Thanks @​DylanPiercey! - Fix issues with incorrect intersection offset encoding in production builds.

• Updated dependencies [ae034a5, ae034a5]:

  • @​marko/runtime-tags@​6.0.159

marko@5.38.32

... (truncated)

Changelog

Sourced from marko's changelog.

5.38.36

Patch Changes

• #3159 19d4b37 Thanks @​DylanPiercey! - Fix escaping issue for dynamic text interpolation inside <script>, <style>, <html-script> and <html-style> tags.

  The issue was that the escaping logic for those tags used a CASE SENSITIVE search for the closing tag which could be bypassed like so:

  <script>${"</SCRIPT><img src=x onerror=alert('uh oh')>"}</script>

  Note that script and style there should never render unsanitized user defined values, regardless of wether or not the closing tag is escaped, since these are conceptually just "eval".

• #3159 19d4b37 Thanks @​DylanPiercey! - Fix escaping for <html-comment> tag. Previously this tag relied on normal xml escaping which looks for <. This PR updates to have a special escape for <html-comment> tags that replaces > instead.

  // Previously incorrectly escaped.
  <html-comment>${">Uh oh"}</html-comment>

• Updated dependencies [19d4b37, 19d4b37]:

  • @​marko/runtime-tags@​6.0.164

5.38.35

Patch Changes

• #3145 654fdc2 Thanks @​DylanPiercey! - Improve support for class/tags interop when using legacy renderer apis.

• Updated dependencies [654fdc2]:

  • @​marko/runtime-tags@​6.0.162

5.38.34

Patch Changes

• #3137 d965e38 Thanks @​LuLaValva! - Add types for tag

• Updated dependencies [d965e38, c9d7389]:

  • @​marko/runtime-tags@​6.0.160

5.38.33

Patch Changes

• #3135 ae034a5 Thanks @​DylanPiercey! - Fix issues with incorrect intersection offset encoding in production builds.

... (truncated)

Commits

• 8e7eb50 [ci] release
• 19d4b37 fix: html script, style, and comment escaping
• 725e289 [ci] release
• fbdd2ad [ci] release (#3139)
• d965e38 fix: add media to meta tag types (#3137)
• c9d7389 chore: update types for <button> (#3138)
• f284f58 [ci] release (#3136)
• 029954d [ci] release (#3134)
• c947d1f feat: add spell checking (#3127)
• 1eca6d0 [ci] release (#3126)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for marko since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.