chore(deps-dev): bump marko from 5.38.29 to 5.38.36

[dependabot]

Bumps marko from 5.38.29 to 5.38.36.

Release notes

Sourced from marko's releases.

marko@5.38.36

Patch Changes

• #3159 19d4b37 Thanks @​DylanPiercey! - Fix escaping issue for dynamic text interpolation inside <script>, <style>, <html-script> and <html-style> tags.

  The issue was that the escaping logic for those tags used a CASE SENSITIVE search for the closing tag which could be bypassed like so:

  <script>${"</SCRIPT><img src=x onerror=alert('uh oh')>"}</script>

  Note that script and style there should never render unsanitized user defined values, regardless of wether or not the closing tag is escaped, since these are conceptually just "eval".

• #3159 19d4b37 Thanks @​DylanPiercey! - Fix escaping for <html-comment> tag. Previously this tag relied on normal xml escaping which looks for <. This PR updates to have a special escape for <html-comment> tags that replaces > instead.

  // Previously incorrectly escaped.
  <html-comment>${">Uh oh"}</html-comment>

• Updated dependencies [19d4b37, 19d4b37]:

  • @​marko/runtime-tags@​6.0.164

marko@5.38.35

Patch Changes

• #3145 654fdc2 Thanks @​DylanPiercey! - Improve support for class/tags interop when using legacy renderer apis.

• Updated dependencies [654fdc2]:

  • @​marko/runtime-tags@​6.0.162

marko@5.38.34

Patch Changes

• #3137 d965e38 Thanks @​LuLaValva! - Add types for tag

• Updated dependencies [d965e38, c9d7389]:

  • @​marko/runtime-tags@​6.0.160

marko@5.38.33

Patch Changes

• #3135 ae034a5 Thanks @​DylanPiercey! - Fix issues with incorrect intersection offset encoding in production builds.

• Updated dependencies [ae034a5, ae034a5]:

  • @​marko/runtime-tags@​6.0.159

marko@5.38.32

... (truncated)

Changelog

Sourced from marko's changelog.

5.38.36

Patch Changes

• #3159 19d4b37 Thanks @​DylanPiercey! - Fix escaping issue for dynamic text interpolation inside <script>, <style>, <html-script> and <html-style> tags.

  The issue was that the escaping logic for those tags used a CASE SENSITIVE search for the closing tag which could be bypassed like so:

  <script>${"</SCRIPT><img src=x onerror=alert('uh oh')>"}</script>

  Note that script and style there should never render unsanitized user defined values, regardless of wether or not the closing tag is escaped, since these are conceptually just "eval".

• #3159 19d4b37 Thanks @​DylanPiercey! - Fix escaping for <html-comment> tag. Previously this tag relied on normal xml escaping which looks for <. This PR updates to have a special escape for <html-comment> tags that replaces > instead.

  // Previously incorrectly escaped.
  <html-comment>${">Uh oh"}</html-comment>

• Updated dependencies [19d4b37, 19d4b37]:

  • @​marko/runtime-tags@​6.0.164

5.38.35

Patch Changes

• #3145 654fdc2 Thanks @​DylanPiercey! - Improve support for class/tags interop when using legacy renderer apis.

• Updated dependencies [654fdc2]:

  • @​marko/runtime-tags@​6.0.162

5.38.34

Patch Changes

• #3137 d965e38 Thanks @​LuLaValva! - Add types for tag

• Updated dependencies [d965e38, c9d7389]:

  • @​marko/runtime-tags@​6.0.160

5.38.33

Patch Changes

• #3135 ae034a5 Thanks @​DylanPiercey! - Fix issues with incorrect intersection offset encoding in production builds.

... (truncated)

Commits

• 8e7eb50 [ci] release
• 19d4b37 fix: html script, style, and comment escaping
• 725e289 [ci] release
• fbdd2ad [ci] release (#3139)
• d965e38 fix: add media to meta tag types (#3137)
• c9d7389 chore: update types for <button> (#3138)
• f284f58 [ci] release (#3136)
• 029954d [ci] release (#3134)
• c947d1f feat: add spell checking (#3127)
• 1eca6d0 [ci] release (#3126)
• Additional commits viewable in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: fa3ae46

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[LuLaValva]

Looks like it downgraded evo-marko from ^6 to ^5, we need to figure out how to configure this

[LuLaValva]

Closing in favor of #656

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.