Please update to version 10 of Highlight.js. v9 has multiple security issues.
joshgoebel opened this issue · 0 comments
joshgoebel commented
Please update your dependencies and instructions to use version 10 of Highlight.js. It is not good to encourage any users to continue to use version 9, as your README currently does. At a minimum, the potential security issues should be clearly explained (with a link) - but I can't think of any reason to not just go ahead and resolve by upgrading.
Reference:
- https://github.com/highlightjs/highlight.js/blob/master/VERSION_10_UPGRADE.md
- https://github.com/highlightjs/highlight.js/blob/master/VERSION_10_BREAKING_CHANGES.md
- https://github.com/highlightjs/highlight.js/blob/master/SECURITY.md
- GHSA-7wwv-vh3v-89cq
Also possible useful/relevant:
- highlightjs/highlight.js#3008
- https://github.com/highlightjs/highlight.js/blob/master/extra/3RD_PARTY_QUICK_START.md
We now have pretty clear standards for how 3rd party grammar repos should be structured and our own build system can help you build a CDN distributable as well. 3rd party quick starts going into more detail.