microsoft / microsoft/monaco-editor
[Bug] Why versions of marked and dompurify are fixed?
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 46.8k
- Forks
- 4.1k
- Avg merge
- 17h 58m
- Merged PRs (30d)
- 1
Description
Reproducible in vscode.dev or in VS Code Desktop?
- Not reproducible in vscode.dev or VS Code Desktop
Reproducible in the monaco editor playground?
- Not reproducible in the monaco editor playground
Monaco Editor Playground Link
No response
Monaco Editor Playground Code
Reproduction Steps
npm install monaco-editor
Actual (Problematic) Behavior
Right now in published monaco-editor/package.json dependencies marked and dompurify have fixed versions. Dompurify 3.2.7 has vulnerabilities (see #5248). If dompurify dependency supports ranges, I could get rid of the vulnerability warnings and install the updated version of Dompurify transitively.
Expected Behavior
Provide ranges in package.json for dependencies
"dependencies": {
"marked": "^14.0.0",
"dompurify": "^3.2.7"
},
No response
Additional Context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the published package.json produced by the monaco-editor package and inspect the marked and dompurify dependency entries. Run npm install monaco-editor to verify the installed dependency versions. Done means the published package.json uses the requested compatible ranges and allows an updated dompurify version to be installed transitively.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100