Skip to content

🚨 [security] Update @astrojs/mdx 4.3.4 → 5.0.4 (major)#557

Open
depfu[bot] wants to merge 1 commit into
productionfrom
depfu/update/npm/@astrojs/mdx-5.0.4
Open

🚨 [security] Update @astrojs/mdx 4.3.4 → 5.0.4 (major)#557
depfu[bot] wants to merge 1 commit into
productionfrom
depfu/update/npm/@astrojs/mdx-5.0.4

Conversation

@depfu
Copy link
Copy Markdown
Contributor

@depfu depfu Bot commented Apr 29, 2026

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ @​astrojs/mdx (4.3.4 → 5.0.4) · Repo

Sorry, we couldn't find anything useful about this release.

✳️ js-yaml (4.1.0 → 4.1.1) · Repo · Changelog

Security Advisories 🚨

🚨 js-yaml has prototype pollution in merge (<<)

Impact

In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted.

Patches

Problem is patched in js-yaml 4.1.1 and 3.14.2.

Workarounds

You can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).

References

https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html

Release Notes

4.1.1 (from changelog)

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

↗️ @​mdx-js/mdx (indirect, 3.1.0 → 3.1.1) · Repo · Changelog

Release Notes

3.1.1

Fix

Types

  • 933ab44 @mdx-js/mdx: add attributes to export/import declarations

Docs

Full Changelog: 3.1.0...3.1.1

Does any of this look wrong? Please let us know.

↗️ acorn (indirect, 8.15.0 → 8.16.0) · Repo

Commits

See the full diff on Github. The new version differs by 22 commits:

↗️ remark-mdx (indirect, 3.1.0 → 3.1.1) · Repo · Changelog

Release Notes

3.1.1

Fix

Types

  • 933ab44 @mdx-js/mdx: add attributes to export/import declarations

Docs

Full Changelog: 3.1.0...3.1.1

Does any of this look wrong? Please let us know.

↗️ smol-toml (indirect, 1.4.2 → 1.6.1) · Repo

Security Advisories 🚨

🚨 smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines

Summary

An attacker can send a maliciously crafted TOML to cause the parser to crash, because of a stack overflow caused by thousands of consecutive commented lines.

The library uses recursion internally while parsing to skip over commented lines, which can be exploited to crash an application that is processing arbitrary TOML documents.

Proof of concept

require("smol-toml").parse('# comment\n'.repeat(8000) + 'key = "value"')

Impact

Applications which parse arbitrary TOML documents may suffer availability issues if they receive malicious input. If uncaught, the crash may cause the application itself to crash. The impact is deemed minor, as the function is already likely to throw errors on invalid input. Downstream users are supposed to properly handle errors in such situations.

Due to the design of most JavaScript runtimes, the uncontrolled recursion does not lead to excessive memory usage and the execution is quickly aborted.

As a reminder, it is strongly advised when working with untrusted user input to expect errors to occur and to appropriately catch them.

Patches

Version 1.6.1 uses a different approach for parsing comments, which no longer involves recursion.

Workarounds

Wrap all invocations of parse and stringify in a try/catch block when dealing with untrusted user input.

Release Notes

1.6.1

This release addresses a minor security vulnerability where an attacker-controlled TOML document can exploit an unrestricted recustion and cause a stack overflow error with a document that contains thousands of sucessive commented lines. Security advisory: GHSA-v3rj-xjv7-4jmq

1.6.0

As of this version, smol-toml now supports the newly released TOML 1.1.0 specification!

Highlights

Multiline inline tables

TOML 1.1.0 now allows inline tables to have newlines, as well as trailing commas.

database = {
  driver = "postgresql",
  server = {
    host = "127.0.0.1",
    port = 3307,
  },
}

Omitting seconds in datetime and time

TOML 1.1.0 renders the seconds component of time elements optional.

datetime-tz = 1979-05-27 07:32Z
datetime = 2001-09-21 10:17
time = 13:37

New string escapes

Strings now support 2 additional escape sequences:

  • \xHH for code points between 0 and 255
  • \e for the escape character (U+001B)

What's Changed

Full Changelog: v1.5.2...v1.6.0

1.5.2

Hot fix for v1.5.1... 🙃

What's Changed

  • fix: properly stringify arrays of tables by @cyyynthia

Full Changelog: v1.5.1...v1.5.2

1.5.1

Smol fix that makes newlines actually consistent when stringifying objects to TOML.

What's Changed

Full Changelog: v1.5.0...v1.5.1

1.5.0

This version improves the TOML output of the library when stringifying objects, courtesy of the folks over at Cloudflare.

Most notably, the lib no longer emits unnecessary table headers, and doesn't add an empty line between successive table headers anymore:

[look.at.me]
note = "In earlier versions, there would've been [look] and [look.at] generated as well."

[empty.table]

[another.empty.table]

[look.how.compact]

this = "looks"

What's Changed

New Contributors

Full Changelog: v1.4.2...v1.5.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 23 commits:

↗️ source-map (indirect, 0.7.4 → 0.7.6) · Repo · Changelog

Release Notes

0.7.6

Full Changelog: 0.7.5...0.7.6

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ style-to-object (indirect, 1.0.9 → 1.0.14) · Repo · Changelog

Release Notes

1.0.14

1.0.14 (2025-11-16)

Build System

  • deps: bump inline-style-parser from 0.2.6 to 0.2.7 (#818) (31ca552)

1.0.13

1.0.13 (2025-11-16)

Documentation

  • readme: replace badgen.net with shields.io status badges (34d0947)

1.0.12

1.0.12 (2025-10-24)

Build System

  • deps: bump inline-style-parser from 0.2.4 to 0.2.6 (#774) (50aa645)

1.0.11

1.0.11 (2025-10-03)

Bug Fixes

1.0.10

1.0.10 (2025-10-02)

Bug Fixes

Miscellaneous Chores

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ unist-util-visit (indirect, 5.0.0 → 5.1.0) · Repo

Release Notes

5.1.0

Types

Full Changelog: 5.0.0...5.1.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ unist-util-visit-parents (indirect, 6.0.1 → 6.0.2) · Repo

Release Notes

6.0.2

  • 579ffbc Fix type support for readonly arrays

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 6 commits:

🆕 @​shikijs/primitive (added, 4.0.2)

🆕 piccolore (added, 0.1.3)

🗑️ yaml (removed)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added the depfu label Apr 29, 2026
@depfu depfu Bot mentioned this pull request Apr 29, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants