Vulnerable Dependency

[jasonchavez520]

Remark Parse using old/vulnerable trim library. According to snyk, trim 0.0.1 is vulnerable to the following: https://snyk.io/vuln/SNYK-JS-TRIM-1017038

Can trim be updated to version 1.0.0?

Thank you.

[ChristianMurphy]

remark-parse doesn't use trim, here is the current dependency tree.

[email protected]
└─┬ [email protected]
  ├─┬ @types/[email protected]
  │ └── @types/[email protected]
  ├── [email protected]
  ├─┬ [email protected]
  │ ├─┬ [email protected]
  │ │ └── [email protected]
  │ └── [email protected] deduped
  ├─┬ [email protected]
  │ ├── [email protected]
  │ ├── [email protected]
  │ ├── [email protected]
  │ ├─┬ [email protected]
  │ │ ├── [email protected]
  │ │ └── [email protected] deduped
  │ ├── [email protected]
  │ └── [email protected]
  └─┬ [email protected]
    └── @types/[email protected] deduped

You may be on an old version or remark, or have locked trim in with a yarn.lock or package-lock.json file.
Consider upgrading remark/remark parse, and running npm upgrade or yarn upgrade.