Remarkable Dependency Vulnerability

[KarinBlanford]

The dependency Remarkable has been updated to use autolinker v3.0.0+ as there was a DOS vulnerability in autolinker v0.28.1 (https://snyk.io/vuln/SNYK-JS-AUTOLINKER-73494).

Updating Remarkable to v2.0.0+ will resolve the issue.

Old - https://github.com/jonschlinkert/remarkable/blob/v1.7.4/package.json#L66
New - https://github.com/jonschlinkert/remarkable/blob/v2.0.0/package.json#L81

Currently unable to install markdown-toc due to older version of autolinker being quarantined on corporate npm registry.

[ramonpetgrave64]

For those still affected, I've been able to get around this by adding an override to my package.json. deps.dev was a huge help to figuring out the dependency chain and that versions higher than autolinker>=0.2.1 is not vulnerable, but v4.0.0 seems to work fine for me. I even cloned the markdown-toc repo, added this fix, and ran its test. They pass!

• https://deps.dev/npm/markdown-toc/1.2.0/dependencies/graph?filter=lodash
• https://deps.dev/npm/autolinker/1.2.1

  "overrides": {
    "autolinker": ">= 4.0.0 ^4.0.0"
  }

I have a pending fix here #195. @KarinBlanford , @jonschlinkert , @doowb