GHSA-3f68-rmx2-j4c9: 
JavaScript vulnerability analysis and mitigation

Impact

The references formatter keeps Markdown links, code spans and code blocks as they are, and three of the regular expressions that find them backtracked in quadratic time: on a long run of [, on a long run of backticks, and on many code fences without a closing one. A subject or a note of 64 KB took 1.5–3 seconds to format, and the time grows with the square of the length. The conventional-changelog-angular and conventional-changelog-conventionalcommits presets run the formatter on the subject and the notes of every commit, so changelog generation over commits from outside contributors is affected.

Patches

Fixed in 1.4.1, where the segments are found in linear time: 1 MB formats in 2–74 ms. The presets accept 1.4.1 in their dependency range, so updating the lockfile is enough.

Workarounds

Truncate long commit subjects and notes before generating a changelog.

References

• #1575