rehype-dom-parse - npm Package Compare versions

Comparing version 2.0.1 to 3.0.0

dist/rehype-dom-parse.js

 'use strict';
 
-function _interopDefault (ex) { return (ex && (typeof ex === 'object') && 'default' in ex) ? ex['default'] : ex; }
+var fromDOM = require('hast-util-from-dom');
 
-var xtend = _interopDefault(require('xtend'));
-var fromDOM = _interopDefault(require('hast-util-from-dom'));
+function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
+var fromDOM__default = /*#__PURE__*/_interopDefaultLegacy(fromDOM);
+
 function parse(options) {
-  var settings = xtend(options, this.data('settings'));
+  var settings = Object.assign({}, options, this.data('settings'));
 
   function parser(doc, file) {
     var create = settings.fragment == null || settings.fragment ? createFragment : createDocument;
-    return fromDOM(create(String(file)));
+    return fromDOM__default['default'](create(String(file)));
   }
@@ -15,0 +16,0 @@

package.json

 {
   "name": "rehype-dom-parse",
-  "version": "2.0.1",
+  "version": "3.0.0",
   "description": "rehype plugin to use browser APIs to parse HTML",
@@ -18,3 +18,3 @@ "license": "ISC",
   "homepage": "https://github.com/rehypejs/rehype-dom",
-  "repository": "https://github.com/rehypejs/rehype-dom/tree/master/packages/rehype-dom-parse",
+  "repository": "https://github.com/rehypejs/rehype-dom/tree/main/packages/rehype-dom-parse",
   "bugs": "https://github.com/rehypejs/rehype-dom/issues",
@@ -32,5 +32,4 @@ "author": "Keith McKnight <[e-mail]> (https://keith.mcknig.ht)",
   "dependencies": {
-    "hast-util-from-dom": "^2.0.1",
-    "xtend": "^4.0.1"
+    "hast-util-from-dom": "^3.0.0"
   }
 }

readme.md

@@ -81,2 +81,8 @@ # rehype-dom-parse
 
+## Security
+
+Use of `rehype-dom-parse` can open you up to a [cross-site scripting (XSS)][xss]
+attack if the DOM is unsafe.
+Use [`rehype-sanitize`][sanitize] to make the tree safe.
+
 ## Contribute
@@ -130,15 +136,15 @@
 
-[license]: https://github.com/rehypejs/rehype-dom/blob/master/license
+[license]: https://github.com/rehypejs/rehype-dom/blob/main/license
 
 [health]: https://github.com/rehypejs/.github
 
-[contributing]: https://github.com/rehypejs/.github/blob/master/contributing.md
+[contributing]: https://github.com/rehypejs/.github/blob/HEAD/contributing.md
 
-[support]: https://github.com/rehypejs/.github/blob/master/support.md
+[support]: https://github.com/rehypejs/.github/blob/HEAD/support.md
 
-[coc]: https://github.com/rehypejs/.github/blob/master/code-of-conduct.md
+[coc]: https://github.com/rehypejs/.github/blob/HEAD/code-of-conduct.md
 
 [unified]: https://github.com/unifiedjs/unified
 
-[processor]: https://github.com/rehypejs/rehype/blob/master/packages/rehype
+[processor]: https://github.com/rehypejs/rehype/blob/HEAD/packages/rehype
 
@@ -151,2 +157,6 @@ [parser]: https://github.com/unifiedjs/unified#processorparser
 
-[rehype-parse]: https://github.com/rehypejs/rehype/tree/master/packages/rehype-parse
+[rehype-parse]: https://github.com/rehypejs/rehype/tree/HEAD/packages/rehype-parse
+
+[xss]: https://en.wikipedia.org/wiki/Cross-site_scripting
+
+[sanitize]: https://github.com/rehypejs/rehype-sanitize

New alerts

No repository

Supply chain risk

Package does not have a linked source code repository. Without this field, a package will have no reference to the location of the source code use to generate the package.

Found 1 instance in 1 package

Fixed alerts

No repository

Supply chain risk

Package does not have a linked source code repository. Without this field, a package will have no reference to the location of the source code use to generate the package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

6767

4.35%

Dependency count

1

-50%

Number of lines in readme file

160

6.67%

Worsened metrics

Lines of code

51

-1.92%

Dependency changes

• + Added

  @types/hast@2.3.10
  (transitive)

• + Added

  @types/unist@2.0.11
  (transitive)

• + Added

  hast-util-from-dom@3.0.0
  (transitive)

• + Added

  hastscript@6.0.0
  (transitive)

• - Removed

  xtend@^4.0.1

• - Removed

  hast-util-from-dom@2.0.5
  (transitive)

• - Removed

  hastscript@5.1.2
  (transitive)

• Updated

  hast-util-from-dom@^3.0.0