From 4e7d7ad7a8da998ec349dfb7592680493afc178a Mon Sep 17 00:00:00 2001 From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 13:39:39 +0000 Subject: [PATCH 1/2] chore: upgrade linkify-it to ^5.0.2 to address CVE-2026-59887 Refreshes the yarn.lock entry for linkify-it (transitive via markdown-it) from 5.0.1 to 5.0.2, resolving the quadratic-complexity DoS in the mailto: schema validator scan-loop. Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1579/sourcebot-devsourcebot-cve-2026-59887-linkify-it-quadratic-complexity#agent-session-00ff015e) Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com> --- CHANGELOG.md | 1 + yarn.lock | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b0402dab6..d37305fd7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Upgraded `tar` to `^7.5.20`. [#1474](https://github.com/sourcebot-dev/sourcebot/pull/1474) +- Upgraded `linkify-it` to `^5.0.2`. [#1476](https://github.com/sourcebot-dev/sourcebot/pull/1476) ### Changed - Reduced Sentry span sampling to 10% outside development. [#1475](https://github.com/sourcebot-dev/sourcebot/pull/1475) diff --git a/yarn.lock b/yarn.lock index 051755b31..7110c5f52 100644 --- a/yarn.lock +++ b/yarn.lock @@ -17376,11 +17376,11 @@ __metadata: linkType: hard "linkify-it@npm:^5.0.1": - version: 5.0.1 - resolution: "linkify-it@npm:5.0.1" + version: 5.0.2 + resolution: "linkify-it@npm:5.0.2" dependencies: uc.micro: "npm:^2.0.0" - checksum: 10c0/d06d04f1ed03be131740fc900a5e74ea1f49886b052213599e306d469d5ffe2303db76dd8f771de9f28e2b0b38852de22ec46ae597d245f8b66439b0ceb19b10 + checksum: 10c0/dd70b1735a13d41a2cff0a058ac3771166038f23f6aff004dd53873cf985c64b107902fe0b544a5b3d1ff6e63249cf9c648fb3ae9f285481db48f56887adb0d6 languageName: node linkType: hard From f330929923b9242b80a601e9d0197e59bf39a31b Mon Sep 17 00:00:00 2001 From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 13:40:26 +0000 Subject: [PATCH 2/2] chore: correct CHANGELOG PR link to #1488 Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1579/sourcebot-devsourcebot-cve-2026-59887-linkify-it-quadratic-complexity#agent-session-00ff015e) Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d37305fd7..a745584b8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Upgraded `tar` to `^7.5.20`. [#1474](https://github.com/sourcebot-dev/sourcebot/pull/1474) -- Upgraded `linkify-it` to `^5.0.2`. [#1476](https://github.com/sourcebot-dev/sourcebot/pull/1476) +- Upgraded `linkify-it` to `^5.0.2`. [#1488](https://github.com/sourcebot-dev/sourcebot/pull/1488) ### Changed - Reduced Sentry span sampling to 10% outside development. [#1475](https://github.com/sourcebot-dev/sourcebot/pull/1475)