Bump mammoth from 1.12.1 to 1.13.0

[dependabot]

Bumps mammoth from 1.12.1 to 1.13.0.

Changelog

Sourced from mammoth's changelog.

1.13.0

• Replace the use of bluebird with native promises.

  This is arguably a breaking change: however, the return value of functions such as convertToHtml() was only documented as a promise, rather than as a bluebird promise.

  The only exception is that the docs previously used .done(): therefore, when returning promises from the API to external users, a done method is added.

  Any callers that rely on bluebird promises can convert the returned promise into a bluebird promise using bluebird.Promise.resolve().

• Read the children of w:customXml elements.

• Handle paragraphs and runs that have been moved and tracked as a revision.

• Improve escaping in Markdown writer. This avoids some cases where source documents could inject arbitrary HTML into the converted document.

1.12.3

• Avoid excessive backtracking when parsing an unterminated string with many escape sequences. The previous behaviour would allow maliciously crafted documents to cause a denial of service.

  Note that it is still strongly recommended to process untrusted documents in a separate thread with a timeout to avoid potential similar issues.

• Handle complex field separator and end characters without corresponding start characters.

1.12.2

• Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

Commits

• 791a189 Bump version to 1.13.0
• 4abdfe2 Clarify implication of markdown escaping
• 8e6e755 Escape markdown image alt text and src
• 9463f5c Escape markdown link hrefs
• d302d07 Escape HTML IDs in markdown writer
• 671dbb6 Handle paragraphs and runs that have been moved and tracked as a revision
• d157374 Read the children of w:customXml elements
• 2a489fb Mark up code fragment in README
• adc5749 Update dingbat-to-unicode to 1.0.2
• c0dce8c Remove dependency on path-is-absolute
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)