Bump trim, remark-parse and remark-rehype in /.github/actions/validate-docs-links

[dependabot]

Removes trim. It's no longer used after updating ancestor dependencies trim, remark-parse and remark-rehype. These dependencies need to be updated together.

Removes trim

Updates remark-parse from 7.0.1 to 11.0.0

Release notes

Sourced from remark-parse's releases.

[email protected]

(see 15.0.0)

[email protected]

See [email protected]

[email protected]

See [email protected]

[email protected]

See [email protected]

[email protected]

See [GH-536](https://github.com/remarkjs/remark/issues/536)

[email protected]

See [GH-536](https://github.com/remarkjs/remark/issues/536)

[email protected]

See [email protected]

[email protected]

• 726dc9a8 Fix numbered lists interrupting paragraphs
• 4e613fba Refactor to loosen list parsing

[email protected]

• 0697d461 Fix lists with mixed indentation

[email protected]

• 065561b Move footnotes to remark-footnotes (breaking, footnotes: true no longer works, please see the new external plugin, it includes many fixes)
• 0cec4d8 Add support for emails without protocol (breaking, new behavior matches changes in GFM)
• 512cd7a Fix support for literal URLs (breaking, new behavior matches changes in GFM)
• 4f2a1d4 Fix whitespace between link label and destination (breaking, potentially, [text] (https://github.com/remarkjs/remark/blob/HEAD/url) -> [text](https://github.com/remarkjs/remark/blob/HEAD/url))
• 24cd52d types: add partial interface exports to types (feature)
• 5f9114f types: add tsdocs for parser options (feature)
• b4c993e Fix parsing of non-empty blank lines (patch)
• 4a6dcc9 Add deprecation note for pedantic mode (patch, just docs for now, but if you’re using pedantic: true, please stop)

[email protected]

Project

• 8b2a3ff Add funding fields to packages

... (truncated)

Commits

• de740c7 remark-parse: 11.0.0
• 1a769dd Fix TS generating broken definitions
• 98a2560 Change to require Node.js 16
• 350645a Fix license
• 6a43da8 Refactor docs
• c348aec Refactor some metadata
• a3e6d54 Change to use exports
• bd8c922 Add typed settings
• 63e6ef9 Refactor code-style
• d5a134d Remove tests for things in micromark, mdast utilities
• Additional commits viewable in compare view

Updates remark-rehype from 5.0.0 to 11.1.0

Release notes

Sourced from remark-rehype's releases.

11.1.0

Add

• 0174dfc Add file to options passed to mdast-util-to-hast

Full Changelog: remarkjs/remark-rehype@11.0.0...11.1.0

11.0.0

Change

• 30091c7 Change to require Node.js 16 migrate: update too
• cafeacc Change to use exports migrate: don’t use private APIs
• acb292a Update mdast-util-to-hast, @types/{hast,mdast}, unified, etc migrate: update too if you don’t use handlers, this should be fine; if you do, see [email protected]
• ba50965 Remove Processor type migrate: get it from unified

Add

• b990986 Add exports of defaultFootnoteBackContent, defaultFootnoteBackLabel

Full Changelog: remarkjs/remark-rehype@10.1.0...11.0.0

10.1.0

• f22d7af Add exports of defaultHandlers, all, one by @​JounQin in remarkjs/remark-rehype#23

Full Changelog: remarkjs/remark-rehype@10.0.1...10.1.0

10.0.1

• 1e0c67d Add improved docs by @​wooorm in remarkjs/remark-rehype#22

Full Changelog: remarkjs/remark-rehype@10.0.0...10.0.1

10.0.0

• 2e2401a Update mdast-util-to-hast This changes footnotes to match how GitHub renders them
  • use the new clobberPrefix, footnoteLabel, and footnoteLabelBack options to configure it
• b718673 Fix support for explicit nullish processor

Full Changelog: remarkjs/remark-rehype@9.1.0...10.0.0

9.1.0

• aab88a5 Add raw to hast type registry

... (truncated)

Commits

• 6407b61 11.1.0
• 0174dfc Add file to options passed to mdast-util-to-hast
• cf87ade Update dev-dependencies
• b4799b5 11.0.0
• 30091c7 Change to require Node.js 16
• cafeacc Change to use exports
• b990986 Add exports of defaultFootnoteBackContent, defaultFootnoteBackLabel
• ba50965 Remove Processor type
• 743e91b Refactor docs
• 4009084 Refactor code-style
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[guimachiavelli]

@zeguillen, I believe you're in a better position to assess whether these updates can have any impact on our pipeline.

[zeguillen]

I did a local test with both these new versions and they break the pipeline, they have documented breaking changes (remark-rehype v6), so I would suggest avoiding an update at this time @guimachiavelli

[guimachiavelli]

Sounds like a good idea, yeah. I'm glad I asked your review before blindly merging this one 😅

[guimachiavelli]

According to the developer's guidance, updating remark libraries will break our pipeline.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[curquiza]

Hello @zeguillen

This dependabot update is a security update. I'm not comfortable knowing we are not able to update the dependencies, even if it's on a tool, not on the website itself. The repository is open-source, so the tool is publicly available.

Do you know why we use such an old remark-parse version? v7.0.1 has been released in August 2019
https://github.com/remarkjs/remark/releases/[email protected]

[zeguillen]

Hello @zeguillen

This dependabot update is a security update. I'm not comfortable knowing we are not able to update the dependencies, even if it's on a tool, not on the website itself. The repository is open-source, so the tool is publicly available.

Do you know why we use such an old remark-parse version? v7.0.1 has been released in August 2019 https://github.com/remarkjs/remark/releases/[email protected]

Hey @curquiza,

I've checked with the team and it seems these two libraries are tied to the unified version used when this was developed, based on what other MDX repos were doing at the time. We'll be happy to take a look at researching and updating the dependencies, but it could waterfall into a major rewrite of the tool, and we'll need to open the appropriate ticket for it.

Please let me know!