[Snyk] Security upgrade gatsby-transformer-remark from 2.8.22 to 6.0.0 by dotam99 · Pull Request #53 · dotam99/cloudflare-docs

dotam99 · 2024-02-23T18:48:54Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- developers.cloudflare.com/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Information Exposure SNYK-JS-SANITIZEHTML-6256334	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gatsby-transformer-remark

The new version differs by 250 commits.

0c6cd61 chore(release): Publish
5e8e621 chore: Update main README (#36954)
7130cd4 test(gatsby): Slices API integration tests (#36747)
6496eed chore(release): Publish next
bc7ac84 chore: preserve previous webpack stats derived values, even if we restart webpack itself (#36980)
2b5af32 fix: drop `__renderedByLocation` prop when calculating slice props hashes and don't expose it to slice component (#36979)
cc1ee9b chore(release): Publish next
6a53861 chore(gatsby-link): Correct type export (#36968)
0ad6314 fix(gatsby-graphiql-explorer): Use upstream exporter package (#36966)
964265c chore(release): Publish next
b624442 chore: Update peerDeps (#36965)
b2ab092 chore(release): Publish next
e2a14bf feat(gatsby): Slices <> partial hydration interop (#36960)
0083e62 fix(deps): update starters and examples gatsby packages to ^4.24.7 (#36957)
68e9cab chore(changelogs): update changelogs (#36958)
b9eb8d2 chore(deps): update dependency autoprefixer to ^10.4.13 for gatsby-plugin-sass (#36934)
58c37ea chore(deps): update dependency @ jridgewell/trace-mapping to ^0.3.17 for gatsby-legacy-polyfills (#36933)
a5e4c47 fix(deps): update dependency body-parser to ^1.20.1 for gatsby-source-drupal (#36940)
c86aa7e chore(docs): Add clarification for Pro Tip on Part 4 of tutorial (#36918)
d5c775a feat(gatsby): handle graphql-import-node bundling (#36951)
59e2976 feat(gatsby-remark-embed-snippet): added csproj to language map so it will be recognized as xml (#36919)
c8a7dda chore(docs): Valhalla Content Hub Reference Guide (#36949)
3044280 fix(gatsby): stitch slices if just page html was regenerating without any of used slices regenerating (#36950)
10abdcb chore(release): Publish next

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334

guardrails · 2024-02-23T18:50:09Z

⚠️ We detected 99 security issues in this pull request:

Mode: paranoid | Total findings: 99 | Considered vulnerability: 99

Hard-Coded Secrets (99)

Severity

Details

Docs

Medium

Title: Hex High Entropy String

cloudflare-docs/products/access/wrangler.toml

Line 12 in 0aca3d5

{ binding = "REDIRECTS", id = "8f79dc3f8f5840e1bde3fce52a67d62e" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/argo-tunnel/wrangler.toml

Line 12 in 0aca3d5

{ binding = "REDIRECTS", id = "65462db7fc30456593591d0ee0384869" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/bots/wrangler.toml

Line 12 in 0aca3d5

{ binding = "REDIRECTS", id = "8851304780a744369049e4612d5b7132" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/cloudflare-one/wrangler.toml

Line 12 in 0aca3d5

{ binding = "REDIRECTS", id = "d67abaab47504270a65afcf3f6460f5d" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/firewall/wrangler.toml

Line 12 in 0aca3d5

{ binding = "REDIRECTS", id = "6405ea2c8e794feca7b5dfcc5e53875a" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/gateway/wrangler.toml

Line 12 in 0aca3d5

{ binding = "REDIRECTS", id = "8a91001065b6459483db0b898a58cd2e" }

📚

Medium

Title: Hex High Entropy String

cloudflare-docs/products/warp-client/wrangler.toml

Line 12 in 0aca3d5

{ binding = "REDIRECTS", id = "f28bd6bb32a84aa0b4827c5dc2466bc1" }

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/developers.cloudflare.com/src/components/mdx/directory-listing.js

Line 1 in 0aca3d5

    
           // Keep in sync with https://github.com/cloudflare/cloudflare-docs-engine/blob/ea2031c9575f7785ec9356963fd9cf6e00d2c379/src/components/mdx/directory-listing.js

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/contributing/development-setup.md

Line 9 in 0aca3d5

    
           1. Ensure you’re running node version `>=12.0.0`, as [specified by Docs Engine](https://github.com/cloudflare/cloudflare-docs-engine/blob/765bc30127b0e80b570aade7044036925928c3ea/package.json#L50).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/contributing/development-setup.md

Line 36 in 0aca3d5

    
           4. Run the engine’s [`bootstrap` command](https://github.com/cloudflare/cloudflare-docs-engine/blob/765bc30127b0e80b570aade7044036925928c3ea/bin/commands.sh#L19-L39):

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/contributing/to-cloudflare-docs.md

Line 8 in 0aca3d5

    
           This guide is for contributors to [@cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs). To review the full contribution guidelines, see [Contributing to Cloudflare's Documentation](https://github.com/cloudflare/cloudflare-docs/blob/186d17204a509d4c8514b4c4dafd00974b4713b8/CONTRIBUTING.md).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/faq.md

Line 41 in 0aca3d5

    
           Search is powered by Algolia DocSearch and [must be configured](/reference/configuration) in `docs-config.js`. Make a PR on [@algolia/docsearch-configs](https://github.com/algolia/docsearch-configs/pull/2300) to obtain an `indexName` and `apiKey` (e.g. see the [Workers PR](https://github.com/algolia/docsearch-configs/pull/2300)). Then simply set those values as `search.indexName` and `search.apiKey` (e.g. see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24)). To disable search, set those values to the empty string (e.g. [Docs Engine example site](https://github.com/adamschwartz/docs-engine-example/blob/6d725ffa554454e1daa4c0d2a8a7e44408056e6b/docs-config.js#L21-L24)).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/how-it-works.md

Line 29 in 0aca3d5

    
           However, these files can also be placed inside any sub-folder of your project. When doing this, you’ll need to then customize the `contentRepoFolder` property in `docs-config.js`, which is how the [products inside @cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs/tree/production/products) are all set up, e.g. the [Workers product](https://github.com/cloudflare/cloudflare-docs/blob/1efd366c25bc1bdd1a40f7bc4737310c6b00d15e/products/workers/docs-config.js#L6).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/how-it-works.md

Line 92 in 0aca3d5

    
           The `search` field is used to add a search to the site, powered by Algolia DocSearch. To hide search, set `search.indexName` and `search.apiKey` to the empty string, as in the example above. For an example of a project using search, see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/configuration.md

Line 33 in 0aca3d5

    
           - By default the engine assumes that a docs site’s structure is placed in the root of a project repo. However, this whole structure can also be placed inside any sub-folder by setting this property. For example, this site’s content is inside the [`products/docs-engine` folder](https://github.com/cloudflare/cloudflare-docs/tree/4fd3a4af9507b20bb23fea4d7c4f4cd349c0f463/products/docs-engine) of [@cloudflare/cloudflare-docs](https://github.com/cloudflare/cloudflare-docs) so its `"products/docs-engine"`.

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/configuration.md

Line 48 in 0aca3d5

    
           For an example of a project using search, see the [Workers config](https://github.com/cloudflare/cloudflare-docs/blob/e72247549d20f649786251d0368de19560d1bbb2/products/workers/docs-config.js#L21-L24).

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/pages.md

Line 59 in 0aca3d5

    
           In the [Workers docs](https://developers.cloudflare.com/workers), there’s a partial used in the intro of all of the [Tutorials](https://developers.cloudflare.com/workers/tutorials), called “Before you start” which makes sure folks have the appropriate pre-requisites before starting a Workers tutorial ([source](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/_partials/_tutorials-before-you-start.md)):

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/pages.md

Line 71 in 0aca3d5

    
           Inside the tutorial it’s imported as you would any other MDX component ([source](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/tutorials/build-a-qr-code-generator/index.md)):

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/pages.md

Line 109 in 0aca3d5

    
           You can additional set your own frontmatter props in order to use them as variables inside of your pages. This is how the [Workers “Example” pages](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/examples/alter-headers.md#L12) are constructed.

📚

Medium

Title: Cloudflare API Token

cloudflare-docs/products/docs-engine/src/content/reference/pages.md

Line 123 in 0aca3d5

    
           If within a non-document-type page you’d like to have some content constrained by the normal content column, use the [`<ContentColumn/>` component](/reference/markdown#contentcolumn). The Workers Example pages use this component to [constrain the width](https://github.com/cloudflare/cloudflare-docs/blob/4ba1e70d2a535c93ef6de42b0fc5178dabdb942b/products/workers/src/content/examples/respond-with-another-site.md#L10-L22) of descriptive text while allowing the code example to be showcased.

📚

Medium

Title: Cloudflare Email

cloudflare-docs/.github/workflows/deploy.yml

Line 150 in 0aca3d5