Skip to content

build(deps): bump mammoth from 1.12.0 to 1.12.2 - #3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mammoth-1.12.2
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mammoth-1.12.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps mammoth from 1.12.0 to 1.12.2.

Changelog

Sourced from mammoth's changelog.

1.12.2

  • Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

1.12.1

  • Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

  • Detect and ignore numbering levels that use numStyleLink to refer to themselves.

Commits
  • 8706034 Bump version to 1.12.2
  • 2888fa1 Create objects without prototypes when used as map with arbitrary keys
  • 31f0c37 Avoid prototype pollution when reading styles
  • e3b9cec Bump version to 1.12.1
  • c69ea62 Ignore numbering levels that use numStyleLink to refer to themselves
  • fbf5e22 Check image content type for backslashes
  • 1a495a9 Add note on performance
  • ee59684 Remove donations section
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@dependabot
dependabot Bot requested a review from TheVicky1 as a code owner September 14, 2026 09:10
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 14, 2026
@vercel

vercel Bot commented Sep 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
di-notes Ready Ready Preview Sep 14, 2026 9:29am UTC

@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Sep 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/mammoth-1.12.2 branch from 964fd6f to 02d6ecb Compare September 14, 2026 09:15
Bumps [mammoth](https://github.com/mwilliamson/mammoth.js) from 1.12.0 to 1.12.2.
- [Release notes](https://github.com/mwilliamson/mammoth.js/releases)
- [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS)
- [Commits](mwilliamson/mammoth.js@1.12.0...1.12.2)

---
updated-dependencies:
- dependency-name: mammoth
  dependency-version: 1.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants