Upgrade to Highlight.js v10.4.1 (or higher) about cli-highlight

[joshgoebel]

I believe this is covered fully in GHSA-7wwv-vh3v-89cq. There is no real reason anyone on the v10 series already shouldn't upgrade ASAP.

At a glance I'd assume cli-highlight is definitely at risk from these security issues.

If you have more specific questions I'd be happy to help.

[joshgoebel]

Hard to say if your own repo is at risk, would depend how/if you actually use cli-highlight... (see the advisory)

[felixfbecker]

We depend on highlight.js ^10, so 10.4.1 is within range and will be picked by default on new installs. Existing consumers can easily upgrade to 10.4.1 using npm upgrade/yarn upgrade (same way they would have to upgrade to a new version of cli-highlight).

[joshgoebel]

@felixfbecker I may not be as well versed in npm stuff as you are.

Is there any point in bumping your package.json.lock file (which references an older insecure version), or does that only really apply to developers working directly on the cli-highlight project itself?

[felixfbecker]

Yes, bumping the package-lock.json version will upgrade you to the newer version. npm upgrade should do this to my knowledge.

[corydozen]

My mistake. There's no need to bump the version on this package. It can be upgraded downstream. Thanks for the conversation.