From f649e30fa05c3c3eaa04f8e2d82aff7e812a6935 Mon Sep 17 00:00:00 2001 From: Henk Boelman Date: Sun, 1 Nov 2026 20:20:55 +0100 Subject: [PATCH] Fix markdown-it security alerts and enable Dependabot update PRs Upgrade markdown-it to 14.3.3 to resolve Dependabot alerts #24 (high) and #25 (low). Add a Dependabot config for weekly npm and GitHub Actions update pull requests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 13 +++++++++++++ package-lock.json | 8 ++++---- package.json | 2 +- 3 files changed, 18 insertions(+), 5 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..7617fdd --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,13 @@ +version: 2 +updates: + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + groups: + npm-dependencies: + patterns: ["*"] + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly diff --git a/package-lock.json b/package-lock.json index ef2e2e6..e8ce8d8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "@fontsource-variable/instrument-sans": "^5.2.0", "@fontsource-variable/space-grotesk": "^5.2.0", "@mdit-vue/shared": "^2.1.4", - "markdown-it": "^14.1.0", + "markdown-it": "^14.3.3", "markdown-it-anchor": "^9.2.0", "markdown-it-container": "^4.0.0", "minisearch": "^7.2.0", @@ -124,9 +124,9 @@ } }, "node_modules/markdown-it": { - "version": "14.3.2", - "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/markdown-it/-/markdown-it-14.3.2.tgz", - "integrity": "sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==", + "version": "14.3.3", + "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/markdown-it/-/markdown-it-14.3.3.tgz", + "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index fb7c6e8..6213e9f 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,7 @@ "@fontsource-variable/instrument-sans": "^5.2.0", "@fontsource-variable/space-grotesk": "^5.2.0", "@mdit-vue/shared": "^2.1.4", - "markdown-it": "^14.1.0", + "markdown-it": "^14.3.3", "markdown-it-anchor": "^9.2.0", "markdown-it-container": "^4.0.0", "minisearch": "^7.2.0",