Skip to content

v2.1.1

Choose a tag to compare

View all tags
@tsutsu3 tsutsu3 released this 24 Aug 17:16
· 2 commits to main since this release
v2.1.1
a2943cf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Security release: LinkifyIt.match() was quadratic on untrusted input when linkify is enabled (GHSA-8m2q-wq3r-6hq8).
Affected: <= 2.1.0. Upgrade to 2.1.1.

  • Fix quadratic complexity in LinkifyIt.match(), port of linkify-it 5.0.1 and 5.0.2 (upstream CVE-2026-48801, CVE-2026-59887) (#82)
  • Match validators at a position instead of slicing the tail, needed because Python 3.10 does not optimize the ^ anchor (#82)
  • Allow ; in the email name, matching linkify-it. Behavior change: a;b@example.com is now linkified (#82)
  • Update port.yml (linkify-it v5.0.2) (#82)

Full Changelog: v2.1.0...v2.1.1

Assets 2
Loading