From 26666f70642afa11855b967a00459c265712df23 Mon Sep 17 00:00:00 2001 From: Superbot Helper Date: Fri, 30 Oct 2026 12:24:52 +0000 Subject: [PATCH] Bump markdown-it from 14.3.0 to 14.3.3 GHSA-gfr2-rv44-r23c (fixed in markdown-it 14.3.3 and 15.0.3): a link reference definition whose label or title is never closed is O(n^2) with default options. src/rules_block/reference.ts appends continuation lines with str += lineContent and then keeps indexing the accumulated string with str.charCodeAt and str.slice, so V8 flattens the cons-string once per line and one definition spanning n lines costs O(n^2); the work happens before the rule decides the definition is invalid. This repository renders user markdown server-side: GET /p/:id?surface=N runs server/app.ts renderPostPage -> server/richRender.ts renderMarkdown -> md.render (src) with default block rules. Through that route, a 400,009-byte unclosed link reference definition ("[a]: /u \"" + 200000 "x\n" lines) was measured on both trees, three runs of three samples, alternating trees: a median 5,122.7 ms at markdown-it 14.3.0 against 95.8 ms for the same 400,009 bytes with the leading "[" replaced by "x" (the same-length control), and a median 129.1 ms at 14.3.3. Absolute timings depend on machine load; the ordering between the crafted row and its same-byte-count control does not. package.json and package-lock.json move the single pin ^14.2.0 -> ^14.3.3 and its lock entry 14.3.0 -> 14.3.3; no application source changes. --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5fe8c91..d57d8d9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -15,7 +15,7 @@ "@pierre/diffs": "^1.2.11", "ansi_up": "^6.0.6", "hono": "^4.13.1", - "markdown-it": "^14.2.0", + "markdown-it": "^14.3.3", "shiki": "^4.2.0", "zod": "^3.24.0" }, @@ -6330,9 +6330,9 @@ } }, "node_modules/markdown-it": { - "version": "14.3.0", - "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.0.tgz", - "integrity": "sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==", + "version": "14.3.3", + "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz", + "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index c72c981..2fe55e9 100644 --- a/package.json +++ b/package.json @@ -105,7 +105,7 @@ "@pierre/diffs": "^1.2.11", "ansi_up": "^6.0.6", "hono": "^4.13.1", - "markdown-it": "^14.2.0", + "markdown-it": "^14.3.3", "shiki": "^4.2.0", "zod": "^3.24.0" },