diff --git a/packages/pluggableWidgets/markdown-web/CHANGELOG.md b/packages/pluggableWidgets/markdown-web/CHANGELOG.md index c09dff6c61..6f6c61d82b 100644 --- a/packages/pluggableWidgets/markdown-web/CHANGELOG.md +++ b/packages/pluggableWidgets/markdown-web/CHANGELOG.md @@ -6,6 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ## [Unreleased] +### Changed + +- We updated markdown-it dependencies to mitigate potential security vulnerabilities. + +### Added + +- We added plugin support for subscript and superscript. + ## [1.0.3] - 2026-07-17 ### Security diff --git a/packages/pluggableWidgets/markdown-web/package.json b/packages/pluggableWidgets/markdown-web/package.json index e2f5185f53..8e77c6b01c 100644 --- a/packages/pluggableWidgets/markdown-web/package.json +++ b/packages/pluggableWidgets/markdown-web/package.json @@ -46,7 +46,9 @@ "dependencies": { "@mendix/widget-plugin-component-kit": "workspace:*", "classnames": "^2.5.1", - "markdown-it": "^14.3.0" + "markdown-it": "^15.0.1", + "markdown-it-sub": "^2.0.0", + "markdown-it-sup": "^2.0.0" }, "devDependencies": { "@mendix/automation-utils": "workspace:*", @@ -58,6 +60,6 @@ "@mendix/widget-plugin-hooks": "workspace:*", "@mendix/widget-plugin-platform": "workspace:*", "@mendix/widget-plugin-test-utils": "workspace:*", - "@types/markdown-it": "^14.1.2" + "@types/markdown-it": "^14.2.0" } } diff --git a/packages/pluggableWidgets/markdown-web/src/Markdown.tsx b/packages/pluggableWidgets/markdown-web/src/Markdown.tsx index 5015cf8831..7fd0bf7654 100644 --- a/packages/pluggableWidgets/markdown-web/src/Markdown.tsx +++ b/packages/pluggableWidgets/markdown-web/src/Markdown.tsx @@ -1,12 +1,16 @@ import classNames from "classnames"; import MarkdownIt from "markdown-it"; +import sub from "markdown-it-sub"; +import sup from "markdown-it-sup"; import { ReactElement, useEffect, useRef } from "react"; import { MarkdownContainerProps } from "../typings/MarkdownProps"; import "./ui/Markdown.scss"; const mdParser = new MarkdownIt("default", { typographer: true, linkify: true -}); +}) + .use(sub) + .use(sup); export default function Markdown(props: MarkdownContainerProps): ReactElement { const { stringAttribute } = props; diff --git a/packages/pluggableWidgets/markdown-web/typings/markdown-it-sub.d.ts b/packages/pluggableWidgets/markdown-web/typings/markdown-it-sub.d.ts new file mode 100644 index 0000000000..83efe0134f --- /dev/null +++ b/packages/pluggableWidgets/markdown-web/typings/markdown-it-sub.d.ts @@ -0,0 +1,5 @@ +declare module "markdown-it-sub" { + import type MarkdownIt from "markdown-it"; + const sub: MarkdownIt.PluginSimple; + export default sub; +} diff --git a/packages/pluggableWidgets/markdown-web/typings/markdown-it-sup.d.ts b/packages/pluggableWidgets/markdown-web/typings/markdown-it-sup.d.ts new file mode 100644 index 0000000000..9bd50c22bd --- /dev/null +++ b/packages/pluggableWidgets/markdown-web/typings/markdown-it-sup.d.ts @@ -0,0 +1,5 @@ +declare module "markdown-it-sup" { + import type MarkdownIt from "markdown-it"; + const sup: MarkdownIt.PluginSimple; + export default sup; +} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 62508aadd8..96e27adb0e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -376,7 +376,7 @@ importers: version: link:../../shared/eslint-config-web-widgets '@mendix/pluggable-widgets-tools': specifier: 11.12.1 - version: 11.12.1(patch_hash=9081455b6de1f5a4af4d792640f6266f917f9ced2d61aae16e64a379ad11faa2)(@jest/transform@30.3.0)(@jest/types@30.4.1)(@types/babel__core@7.20.5)(@types/node@24.12.4)(canvas@3.2.3)(eslint@9.39.5(jiti@2.6.1))(jest-util@30.4.1)(picomatch@4.0.5)(prettier@3.9.6)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(tslib@2.8.1) + version: 11.12.1(patch_hash=9081455b6de1f5a4af4d792640f6266f917f9ced2d61aae16e64a379ad11faa2)(@jest/transform@30.3.0)(@jest/types@30.4.1)(@types/babel__core@7.20.5)(@types/node@24.12.4)(canvas@3.2.3)(eslint@9.39.5(jiti@2.6.1))(jest-util@30.4.1)(prettier@3.9.6)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(tslib@2.8.1) '@mendix/prettier-config-web-widgets': specifier: workspace:* version: link:../../shared/prettier-config-web-widgets @@ -1890,8 +1890,14 @@ importers: specifier: ^2.5.1 version: 2.5.1 markdown-it: - specifier: ^14.3.0 - version: 14.3.0 + specifier: ^15.0.1 + version: 15.0.1 + markdown-it-sub: + specifier: ^2.0.0 + version: 2.0.0 + markdown-it-sup: + specifier: ^2.0.0 + version: 2.0.0 devDependencies: '@mendix/automation-utils': specifier: workspace:* @@ -1901,7 +1907,7 @@ importers: version: link:../../shared/eslint-config-web-widgets '@mendix/pluggable-widgets-tools': specifier: 11.12.1 - version: 11.12.1(patch_hash=9081455b6de1f5a4af4d792640f6266f917f9ced2d61aae16e64a379ad11faa2)(@jest/transform@30.3.0)(@jest/types@30.4.1)(@types/babel__core@7.20.5)(@types/node@24.12.4)(canvas@3.2.3)(eslint@9.39.5(jiti@2.6.1))(jest-util@30.4.1)(prettier@3.9.6)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(tslib@2.8.1) + version: 11.12.1(patch_hash=9081455b6de1f5a4af4d792640f6266f917f9ced2d61aae16e64a379ad11faa2)(@jest/transform@30.3.0)(@jest/types@30.4.1)(@types/babel__core@7.20.5)(@types/node@24.12.4)(canvas@3.2.3)(eslint@9.39.5(jiti@2.6.1))(jest-util@30.4.1)(picomatch@4.0.5)(prettier@3.9.6)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(tslib@2.8.1) '@mendix/prettier-config-web-widgets': specifier: workspace:* version: link:../../shared/prettier-config-web-widgets @@ -1921,8 +1927,8 @@ importers: specifier: workspace:* version: link:../../shared/widget-plugin-test-utils '@types/markdown-it': - specifier: ^14.1.2 - version: 14.1.2 + specifier: ^14.2.0 + version: 14.2.0 packages/pluggableWidgets/pie-doughnut-chart-web: dependencies: @@ -4614,7 +4620,6 @@ packages: '@plotly/mapbox-gl@1.13.4': resolution: {integrity: sha512-sR3/Pe5LqT/fhYgp4rT4aSFf1rTsxMbGiH6Hojc7PH36ny5Bn17iVFUjpzycafETURuFbLZUfjODO8LvSI+5zQ==} engines: {node: '>=6.4.0'} - deprecated: This package is deprecated as of August 2026. plotly.js v4 uses MapLibre for map traces — see https://github.com/maplibre/maplibre-gl-js. '@plotly/point-cluster@3.1.9': resolution: {integrity: sha512-MwaI6g9scKf68Orpr1pHZ597pYx9uP8UEFXLPbsCmuw3a84obwz6pnMXGc90VhgDNeNiLEdlmuK7CPo+5PIxXw==} @@ -5749,8 +5754,8 @@ packages: '@types/mapbox__vector-tile@1.3.4': resolution: {integrity: sha512-bpd8dRn9pr6xKvuEBQup8pwQfD4VUyqO/2deGjfpe6AwC8YRlyEipvefyRJUSiCJTZuCb8Pl1ciVV5ekqJ96Bg==} - '@types/markdown-it@14.1.2': - resolution: {integrity: sha512-promo4eFwuiW+TfGxhi+0x3czqTYJkG8qB17ZUJiVF10Xm7NLVRSLUsfRTU/6h1e24VvRnXCx+hG7li58lkzog==} + '@types/markdown-it@14.2.0': + resolution: {integrity: sha512-NoQ2yGlLWj4wpxMs+TYmRKk3thDrQ97agr7sFqfLsAlvoS8SNQuTrlObhFqG9iugdTtgOE9jpJ6FNM4ZGsa5xQ==} '@types/mdurl@2.0.0': resolution: {integrity: sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg==} @@ -6171,6 +6176,9 @@ packages: argparse@2.0.1: resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==} + argparse@3.0.1: + resolution: {integrity: sha512-nM4mHF/KM1v59ZNKX7zfusQz5wUAxR511YG8Vo6TyiV4aqhu++rbJW4v04xsWhpSsHFj66flT8P7znVpyO20xQ==} + argue-cli@3.1.0: resolution: {integrity: sha512-DhBpBfXL4SS2uC0N922MMajKR3CdrTG0u2or1PNYgXMsrSzViJrbtvT0nCLlLGUI0plam/ZZCs7aAauHtW9thw==} engines: {node: '>=22'} @@ -7135,14 +7143,14 @@ packages: entities@2.2.0: resolution: {integrity: sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==} - entities@4.5.0: - resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==} - engines: {node: '>=0.12'} - entities@6.0.1: resolution: {integrity: sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==} engines: {node: '>=0.12'} + entities@8.0.0: + resolution: {integrity: sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==} + engines: {node: '>=20.19.0'} + env-paths@2.2.1: resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==} engines: {node: '>=6'} @@ -8611,8 +8619,8 @@ packages: lines-and-columns@1.2.4: resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==} - linkify-it@5.0.2: - resolution: {integrity: sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==} + linkify-it@6.1.0: + resolution: {integrity: sha512-wJ/TwpSDTLepCrQoYWYIExIKg5Zchex2Nn5yk2mFnB+6PtdkHtyLx742md9csRjjOnGkKIS/RrbY7l8D6gT9Vw==} linkifyjs@4.3.3: resolution: {integrity: sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg==} @@ -8737,8 +8745,14 @@ packages: resolution: {integrity: sha512-lgL7XpIwsgICiL82ITplfS7IGwrB1OJIw/pCvprDp2dhmSSEBgmPzYRvwYYYvJGJD7fxUv1Tvpih4nZ6VrLuaA==} engines: {node: '>=16.14.0', npm: '>=8.1.0'} - markdown-it@14.3.0: - resolution: {integrity: sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==} + markdown-it-sub@2.0.0: + resolution: {integrity: sha512-iCBKgwCkfQBRg2vApy9vx1C1Tu6D8XYo8NvevI3OlwzBRmiMtsJ2sXupBgEA7PPxiDwNni3qIUkhZ6j5wofDUA==} + + markdown-it-sup@2.0.0: + resolution: {integrity: sha512-5VgmdKlkBd8sgXuoDoxMpiU+BiEt3I49GItBzzw7Mxq9CxvnhE/k09HFli09zgfFDRixDQDfDxi0mgBCXtaTvA==} + + markdown-it@15.0.1: + resolution: {integrity: sha512-9/7gE95FNPkfUWrjJIoHZza2iLmuJlPD0UNMxPi7bxUrbCR525YZY0r+zyfes0dZI5ZZ/uNIXUJca0pJvtw41g==} hasBin: true match-sorter@8.3.0: @@ -10717,8 +10731,8 @@ packages: engines: {node: '>=14.17'} hasBin: true - uc.micro@2.1.0: - resolution: {integrity: sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==} + uc.micro@3.0.0: + resolution: {integrity: sha512-U3PppEkleoTnIfi8BozMx3yju3qc/L6SwqWo2Sw+54PX+PX0q9I+r1Um5HCmqD7n9VDX5/v3vQH/AjA6deDdtw==} uglify-js@3.19.3: resolution: {integrity: sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ==} @@ -14076,7 +14090,7 @@ snapshots: '@types/mapbox__point-geometry': 0.1.4 '@types/pbf': 3.0.5 - '@types/markdown-it@14.1.2': + '@types/markdown-it@14.2.0': dependencies: '@types/linkify-it': 5.0.0 '@types/mdurl': 2.0.0 @@ -14477,6 +14491,8 @@ snapshots: argparse@2.0.1: {} + argparse@3.0.1: {} + argue-cli@3.1.0: {} aria-hidden@1.2.6: @@ -15562,10 +15578,10 @@ snapshots: entities@2.2.0: {} - entities@4.5.0: {} - entities@6.0.1: {} + entities@8.0.0: {} + env-paths@2.2.1: {} errno@0.1.8: @@ -17599,9 +17615,9 @@ snapshots: lines-and-columns@1.2.4: {} - linkify-it@5.0.2: + linkify-it@6.1.0: dependencies: - uc.micro: 2.1.0 + uc.micro: 3.0.0 linkifyjs@4.3.3: {} @@ -17760,14 +17776,18 @@ snapshots: tinyqueue: 3.0.0 vt-pbf: 3.1.3 - markdown-it@14.3.0: + markdown-it-sub@2.0.0: {} + + markdown-it-sup@2.0.0: {} + + markdown-it@15.0.1: dependencies: - argparse: 2.0.1 - entities: 4.5.0 - linkify-it: 5.0.2 + argparse: 3.0.1 + entities: 8.0.0 + linkify-it: 6.1.0 mdurl: 2.1.0 punycode.js: 2.3.1 - uc.micro: 2.1.0 + uc.micro: 3.0.0 match-sorter@8.3.0: dependencies: @@ -20241,7 +20261,7 @@ snapshots: typescript@5.9.3: {} - uc.micro@2.1.0: {} + uc.micro@3.0.0: {} uglify-js@3.19.3: optional: true