Current version of marked creates npm audit issue

[joehuanguf]

npm is giving me a security issue with the current version of the marked dependency. It recommends that we upgrade to 0.7.0.

[fabb]

Related: 2e7f73f

[lukemarsh]

@fabb I see that marked has been downgraded but the issue has been fixed in the 0.7.0 patch

[fabb]

Yes. When marked is upgraded, the linked issue with sanitized inline elements will need fixing.

[XGHeaven]

@fabb I found that marked has been downgraded at version 8.0.0. But @storybook/addon-info still use ^7.0.0. It's also not works. 😭

[ranand]

marked is at 0.8.0 now. is it possible to upgrade marked version in package.json?

[TheresaBeckerLR]

marked is at 0.8.0 now. is it possible to upgrade marked version in package.json?

Any word on this?

[christianalfoni]

Hi there!

Version 0.8.0 breaks a lot of tests and needs to be reviewed. I have a bit too much on my plate these days, but will look at it if I get a chance! 😄

[ilias-t]

any update on this?

[patsplat]

#98 should patch this up. The test failures were b/c of the CI configuration.

[nikkypyra]

Could you please update the following package due to vulnerabilities:
marked to 4.0.10 or greater

This will resolve the vulnerability in marked (See CVE).

[kolesnikanton]

I updated the marked version here: #367
Could I ask you @Hypnosphi @ndelangen @jimmyandrade to release a new version with the changes?