CVE-2022-34749

Advisory

Schema-salad 8.3.20221209165047 stops using its NPM dependency 'mistune' 0.8.x for HTML generation to avoid a vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Starting with 8.3.20221209165047 **we no longer use mistune 0.8.x for HTML generation, [which has an unresolved security vulnerability CVE-2022-34749](https://www.cve.org/CVERecord?id=CVE-2022-34749)**

What's Changed
* update mistune to more recent version by fmigneault in https://github.com/common-workflow-language/schema_salad/pull/619
* Fix the description of the record field annotation for link validation by tom-tan in https://github.com/common-workflow-language/schema_salad/pull/631
* Clarify link fields by tom-tan in https://github.com/common-workflow-language/schema_salad/pull/633
* dlang: fix mis-annotated link annotation by tom-tan in https://github.com/common-workflow-language/schema_salad/pull/632
* Improve embedded document for dlang codegen by tom-tan in https://github.com/common-workflow-language/schema_salad/pull/630

misc
* Update my email address by tetron in https://github.com/common-workflow-language/schema_salad/pull/634
* Rename configuration option removed in tox 4.0 by nsoranzo in https://github.com/common-workflow-language/schema_salad/pull/635
* organize dev requirements by mr-c in https://github.com/common-workflow-language/schema_salad/pull/636


**Full Changelog**: https://github.com/common-workflow-language/schema_salad/compare/8.3.20221115203138...8.3.20221209165047

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34749