Skip to content

Commit 4e7d7ad

Browse files
chore: upgrade linkify-it to ^5.0.2 to address CVE-2026-59887
Refreshes the yarn.lock entry for linkify-it (transitive via markdown-it) from 5.0.1 to 5.0.2, resolving the quadratic-complexity DoS in the mailto: schema validator scan-loop. Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1579/sourcebot-devsourcebot-cve-2026-59887-linkify-it-quadratic-complexity#agent-session-00ff015e) Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
1 parent 08cf01d commit 4e7d7ad

2 files changed

Lines changed: 4 additions & 3 deletions

File tree

CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
99

1010
### Fixed
1111
- Upgraded `tar` to `^7.5.20`. [#1474](https://github.com/sourcebot-dev/sourcebot/pull/1474)
12+
- Upgraded `linkify-it` to `^5.0.2`. [#1476](https://github.com/sourcebot-dev/sourcebot/pull/1476)
1213

1314
### Changed
1415
- Reduced Sentry span sampling to 10% outside development. [#1475](https://github.com/sourcebot-dev/sourcebot/pull/1475)

yarn.lock

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17376,11 +17376,11 @@ __metadata:
1737617376
linkType: hard
1737717377

1737817378
"linkify-it@npm:^5.0.1":
17379-
version: 5.0.1
17380-
resolution: "linkify-it@npm:5.0.1"
17379+
version: 5.0.2
17380+
resolution: "linkify-it@npm:5.0.2"
1738117381
dependencies:
1738217382
uc.micro: "npm:^2.0.0"
17383-
checksum: 10c0/d06d04f1ed03be131740fc900a5e74ea1f49886b052213599e306d469d5ffe2303db76dd8f771de9f28e2b0b38852de22ec46ae597d245f8b66439b0ceb19b10
17383+
checksum: 10c0/dd70b1735a13d41a2cff0a058ac3771166038f23f6aff004dd53873cf985c64b107902fe0b544a5b3d1ff6e63249cf9c648fb3ae9f285481db48f56887adb0d6
1738417384
languageName: node
1738517385
linkType: hard
1738617386

0 commit comments

Comments
 (0)