Repository navigation
v3.2.8
What's new
Bug Fixes
Security: markdownlint-cli has been bumped from 0.48.0 to 0.49.1 to pull in patched versions of two transitive dependencies flagged by OSSF Scorecard's OSV scan (code-scanning alert #28): js-yaml (4.1.1 → 5.2.2) and markdown-it (14.1.1 → 14.3.0). Both packages were pinned by markdownlint-cli's own dependency ranges (js-yaml: ~4.1.1, markdown-it: ~14.1.1) and could not be resolved by bumping top-level version ranges alone — the fix required moving to markdownlint-cli@0.49.1, which requires js-yaml: ~5.2.1 and markdown-it: ~14.3.0.
The advisories addressed are quadratic-complexity denial-of-service issues: GHSA-52cp-r559-cp3m and GHSA-h67p-54hq-rp68 (high/moderate severity CPU exhaustion via YAML merge-key chains and repeated aliases in js-yaml), and GHSA-6v5v-wf23-fmfq (moderate severity DoS in markdown-it's smartquotes rule). markdownlint-cli is a devDependency used for ad hoc Markdown linting and is not wired into the published plugin runtime or CI, so there is no production exposure. The change is scoped to a package.json version bump and a regenerated lockfile, with no source code changes.