Conversation
This allows us to use Kramdown 2.3.0, to resolve GHSA-mqm2-cgpr-p4m6
koddsson
left a comment
There was a problem hiding this comment.
This seems good to me 👍🏻
- The warning
GitHub Metadata: No GitHub API authentication could be found. Some fields may be missing or have incorrect data.is logged when runningbundle exec jekyll buildorbundle exec jekyll servein thedocsdirectory.
I think this is fine if the page is otherwise working.
2. Instead of navigating, clicking the “Reference” button on http://127.0.0.1:4000 duplicates the heading (GIF below). No errors appear in Terminal or the Safari Developer Tools Console.
I can't reproduce locally 🤷🏻
I can consistently repro it in Safari when the viewport is wider than I suspect it’s something like Flexbug #11:
|
Update: Fixed in b7fc3d4 |
Rationale
Jekyll 4.x allows Catalyst to use Kramdown 2.3.0, as suggested by CVE 2020-14001.
Jekyll 3.x to 4.x Upgrade Guide
The upgrade guide notes several changes:
Ruby ≥2.5.0 required — Catalyst could add a
.ruby-versionfile to make this requirement explicit, though since Ruby 2.5.0 was released in 2017, I imagine many folks already have a newer version installed—anecdotally, I did.post_urlnow prependssite.baseurl—git grep post_urldid not show any matches, so this change does not (directly) affect Catalyst.Templates are now parsed once, then cached and rendered multiple times — I don’t know how to asses the impact of this. The description for this change mentions some plugins may behavior differently as a result.
docs/_config.ymllists one plugin,jekyll-github-metadata.Collections (other than
posts) not configured withoutput: truearen’t outputted — Catalyst’sguidecollection is configured withoutput: true, so this change does not affect Catalyst.site.liquid_renderer.file(path).parse(content)is now idempotent (forpath) —git grep liquid_rendererdid not show any matches, so this change does not (directly) affect Catalyst. Additionally, the description for this change mentions it is relevant to plugin authors, but this is a Jekyll site, not a plugin.excludein_config.ymlis now additive, and the default exclude list has expanded —docs/_config.yml’sexcludeconfiguration is now redundant and can be removed, though I haven’t to keep this changeset small and testable/reviewable.Jekyll dropped support for Kramdown 1.x — This was the precipitating reason for this PR, as described above. It’s worth noting that Kramdown 2.0.0 introduced its own set of breaking changes.
Deprecated configuration options have been removed —
docs/_config.ymldoes not include any deprecated configuration options, so this change does not affect Catalyst.🚨 Before Merging 🚨
While testing this branch locally, I’ve noticed the following unexpected behavior, which we should investigate further before merging:
The warning(Update: Ignoring, as advised)GitHub Metadata: No GitHub API authentication could be found. Some fields may be missing or have incorrect data.is logged when runningbundle exec jekyll buildorbundle exec jekyll servein thedocsdirectory.Instead of navigating, clicking the “Reference” button on http://127.0.0.1:4000 duplicates the heading (GIF below). No errors appear in Terminal or the Safari Developer Tools Console.(Update: Fixed in b7fc3d4)