[Snyk] Fix for 1 vulnerabilities #44
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DIFF-14917201
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
This PR addresses a security vulnerability (ReDoS) by upgrading dependencies, but the upgrade introduces breaking changes that are not fully handled in the code.
Changes:
- Upgraded react-markdown from 8.0.7 to 9.0.0 (major version bump with breaking changes)
- Upgraded remark-gfm from 3.0.1 to 4.0.0 (major version bump, ESM-only)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "react-in-viewport": "1.0.0-beta.2", | ||
| "react-intersection-observer": "9.10.3", | ||
| "react-markdown": "8.0.7", | ||
| "react-markdown": "9.0.0", |
There was a problem hiding this comment.
Upgrading react-markdown from 8.0.7 to 9.0.0 introduces breaking changes that will cause compilation errors. The codebase currently uses import { Element } from 'react-markdown/lib/ast-to-react' in src/components/ui/markdown-text.tsx (line 6), but react-markdown v9 removed access to internal /lib/ paths. This import path needs to be updated to use the public API. In react-markdown v9, the Element type should be imported from the main package or replaced with the appropriate type from the hast or mdast type definitions that react-markdown now exports.
| "react-markdown": "9.0.0", | |
| "react-markdown": "8.0.7", |
| "rehype-raw": "6.1.1", | ||
| "rehype-slug": "5.1.0", | ||
| "remark-gfm": "3.0.1", | ||
| "remark-gfm": "4.0.0", |
There was a problem hiding this comment.
Upgrading remark-gfm from 3.0.1 to 4.0.0 is a major version bump that introduces breaking changes. remark-gfm v4 is ESM-only and requires the codebase to properly support ESM modules. Additionally, remark-gfm v4 requires unified v11+ and react-markdown v9+ (which is being upgraded concurrently). Verify that the build system and module resolution are configured to handle ESM-only dependencies correctly, and ensure all dependent code is compatible with these ESM requirements.
| "react-markdown": "9.0.0", | ||
| "react-turnstile": "1.1.3", | ||
| "rehype-raw": "6.1.1", | ||
| "rehype-slug": "5.1.0", | ||
| "remark-gfm": "3.0.1", | ||
| "remark-gfm": "4.0.0", |
There was a problem hiding this comment.
This PR only updates package.json but does not include the necessary code changes to handle the breaking changes introduced by react-markdown v9 and remark-gfm v4. The component in src/components/ui/markdown-text.tsx will fail to compile due to the removed internal import path 'react-markdown/lib/ast-to-react'. A complete fix should include updates to the component code to use the new public API of react-markdown v9. Consider including these code changes in this PR or creating a follow-up task to address them before merging.
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-DIFF-14917201
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Regular Expression Denial of Service (ReDoS)