@11ty/gray-matter
Advanced tools
+1
-12
@@ -38,14 +38,3 @@ 'use strict'; | ||
| parse: function parse(str, options, wrap) { | ||
| /* eslint no-eval: 0 */ | ||
| try { | ||
| if (wrap !== false) { | ||
| str = '(function() {\nreturn ' + str.trim() + ';\n}());'; | ||
| } | ||
| return eval(str) || {}; | ||
| } catch (err) { | ||
| if (wrap !== false && /(unexpected|identifier)/i.test(err.message)) { | ||
| return parse(str, options, false); | ||
| } | ||
| throw new SyntaxError(err); | ||
| } | ||
| throw new Error('Parsing JavaScript in front matter is no longer supported internally in `@11ty/gray-matter`. Support is added upstream in `@11ty/eleventy`.'); | ||
| }, | ||
@@ -52,0 +41,0 @@ stringify: function() { |
+1
-1
| { | ||
| "name": "@11ty/gray-matter", | ||
| "description": "Parse front-matter from a string or file. Fast, reliable and easy to use. Parses YAML front matter by default, but also has support for YAML, JSON, TOML Front-Matter, with options to set custom delimiters. Used by metalsmith, assemble, verb and many other projects.", | ||
| "version": "1.0.0", | ||
| "version": "2.0.0", | ||
| "homepage": "https://github.com/11ty/gray-matter", | ||
@@ -6,0 +6,0 @@ "author": "Jon Schlinkert (https://github.com/jonschlinkert)", |
+3
-2
@@ -8,4 +8,5 @@ # @11ty/gray-matter | ||
| - [Upstream package last released in 2019](https://github.com/jonschlinkert/gray-matter/releases/tag/4.0.2). | ||
| - Upgrades js-yaml major version to v4 | ||
| - Uses Uint8Array interanlly instead of Node-env specific Buffer for more runtime compatibility. | ||
| - Upgrades `js-yaml` major version to v4 | ||
| - Uses Uint8Array internally instead of Node-env specific Buffer for more runtime compatibility. | ||
| - Removes `javascript` front matter type (removing use of `eval`) | ||
@@ -12,0 +13,0 @@ > Parse front-matter from a string or file. Fast, reliable and easy to use. Parses YAML front matter by default, but also has support for YAML, JSON, or TOML Front-Matter, with options to set custom delimiters. |
Potential vulnerability
Supply chain riskInitial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.
Uses eval
Supply chain riskPackage uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
552
0.18%0
-100%35753
-0.35%554
-1.95%