chore(deps): update dependency prismjs to v1.30.0 [security] - #180
chore(deps): update dependency prismjs to v1.30.0 [security]#180renovate[bot] wants to merge 1 commit into
Conversation
Preview sitepr-180: https://pr-180--stuartclark.netlify.app Updated 2026-09-09T23:38:51Z |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #180 +/- ##
=======================================
Coverage 99.77% 99.77%
=======================================
Files 81 81
Lines 1340 1340
Branches 332 332
=======================================
Hits 1337 1337
Misses 3 3 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
✅ Lighthouse Audit ·
|
| Route | FCP | LCP | CLS | TBT | Perf |
|---|---|---|---|---|---|
/ |
✅ 2.8s |
✅ 3.0s |
✅ 0.009 |
✅ 95.000 |
✅ 0.89 |
/about |
✅ 2.6s |
✅ 3.1s |
✅ 0.178 |
✅ 4.500 |
✅ 0.82 |
/community |
✅ 2.6s |
✅ 2.7s |
✅ 0.016 |
✅ 3.000 |
✅ 0.92 |
/open-source |
✅ 2.7s |
✅ 4.8s |
✅ 0.000 |
✅ 0.000 |
✅ 0.78 |
/writing |
✅ 2.7s |
✅ 2.9s |
✅ 0.000 |
✅ 20.000 |
✅ 0.91 |
/writing/custom-formatters-410-20260731 |
✅ 2.9s |
✅ 3.4s |
✅ 0.063 |
✅ 0.000 |
✅ 0.86 |
/writing/decoupling-configuration-config-pages-20220412 |
✅ 2.7s |
✅ 3.0s |
✅ 0.015 |
✅ 0.000 |
✅ 0.90 |
/writing/drupal-site-settings-over-jsonapi-consumer-20260826 |
✅ 2.9s |
✅ 4.1s |
✅ 0.159 |
✅ 0.000 |
✅ 0.75 |
/writing/druxt-drupal-13x-resource-list-yours-20260909 |
✅ 3.2s |
✅ 4.1s |
✅ 0.058 |
✅ 0.000 |
✅ 0.80 |
/writing/field-tokens-200-20260722 |
✅ 2.6s |
✅ 2.8s |
✅ 0.019 |
✅ 0.000 |
✅ 0.92 |
/writing/hello-world-20211126 |
✅ 2.9s |
✅ 3.0s |
✅ 0.142 |
✅ 0.000 |
✅ 0.84 |
/writing/jsonapi-views-120-20260812 |
✅ 2.6s |
✅ 2.8s |
✅ 0.005 |
✅ 0.000 |
✅ 0.92 |
/writing/layout-paragraphs-module-20220301 |
✅ 2.7s |
✅ 2.7s |
✅ 0.055 |
✅ 0.000 |
✅ 0.91 |
Thresholds: FCP ≤ 3.5s, LCP ≤ 5.0s, CLS ≤ 0.25, TBT ≤ 600.000, Perf ≥ 0.75
f74021e to
bec6d2e
Compare
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This PR contains the following updates:
1.29.0→1.30.0PrismJS DOM Clobbering vulnerability
CVE-2024-53382 / GHSA-x7hr-w5r2-h6wg
More information
Details
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
PrismJS/prism (prismjs)
v1.30.0Compare Source
What's Changed
currentScriptis set by a script tag by @lkuechler in #3863New Contributors
Full Changelog: PrismJS/prism@v1.29.0...v1.30.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.