dep: update markdown-it dependency

The commit updates the `markdown-it` dependency in order to resolve a
moderate security vulnerability.

The change also makes `markdown-it` a shared dependency, and updates all
usages to use the shared dep instead of redefining a version in
individual `package.json`.

Signed-off-by: vince-fugnitto <vincent.fugnitto@ericsson.com>

Author: vince-fugnitto

packages/core/README.md

@@ -89,6 +89,7 @@ export class SomeClass {
  - [`inversify@^5.1.1`](https://www.npmjs.com/package/inversify)
  - [`lodash.debounce@^4.0.8`](https://www.npmjs.com/package/lodash.debounce)
  - [`lodash.throttle@^4.1.1`](https://www.npmjs.com/package/lodash.throttle)
+ - [`markdown-it@^12.3.2`](https://www.npmjs.com/package/markdown-it)
  - [`nsfw@^2.1.2`](https://www.npmjs.com/package/nsfw)
  - [`react@^16.8.0`](https://www.npmjs.com/package/react)
  - [`react-dom@^16.8.0`](https://www.npmjs.com/package/react-dom)

packages/core/package.json

@@ -25,6 +25,7 @@
     "@types/fs-extra": "^4.0.2",
     "@types/lodash.debounce": "4.0.3",
     "@types/lodash.throttle": "^4.1.3",
+    "@types/markdown-it": "^12.2.3",
     "@types/react": "^16.8.0",
     "@types/react-dom": "^16.8.0",
     "@types/react-virtualized": "^9.18.3",
@@ -50,7 +51,7 @@
     "keytar": "7.2.0",
     "lodash.debounce": "^4.0.8",
     "lodash.throttle": "^4.1.1",
-    "markdown-it": "^8.4.0",
+    "markdown-it": "^12.3.2",
     "nsfw": "^2.1.2",
     "p-debounce": "^2.1.0",
     "perfect-scrollbar": "^1.3.0",
@@ -92,9 +93,9 @@
       "@phosphor/signaling",
       "@phosphor/virtualdom",
       "@phosphor/widgets",
-      "@theia/application-package:@theia/application-package/index",
       "@theia/application-package/lib/api",
       "@theia/application-package/lib/environment",
+      "@theia/application-package:@theia/application-package/index",
       "fs-extra",
       "fuzzy",
       "inversify",
@@ -110,6 +111,7 @@
       "lodash.debounce as debounce",
       "lodash.throttle as throttle",
       "nsfw",
+      "markdown-it as markdownit",
       "react as React",
       "ws as WebSocket",
       "yargs"

packages/core/shared/markdown-it.d.ts

@@ -0,0 +1,2 @@
+import markdownit = require('markdown-it');
+export = markdownit;

packages/core/shared/markdown-it.js

@@ -0,0 +1 @@
+module.exports = require('markdown-it');

packages/messages/package.json

@@ -4,7 +4,6 @@
   "description": "Theia - Messages Extension",
   "dependencies": {
     "@theia/core": "1.21.0",
-    "markdown-it": "^8.4.0",
     "react-perfect-scrollbar": "^1.5.3",
     "ts-md5": "^1.2.2"
   },

packages/messages/src/browser/notification-content-renderer.ts

@@ -14,7 +14,7 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
  ********************************************************************************/
 
-import * as markdownit from 'markdown-it';
+import * as markdownit from '@theia/core/shared/markdown-it';
 import { injectable } from '@theia/core/shared/inversify';
 
 @injectable()

packages/plugin-ext/package.json

@@ -26,7 +26,6 @@
     "@theia/terminal": "1.21.0",
     "@theia/timeline": "1.21.0",
     "@theia/workspace": "1.21.0",
-    "@types/markdown-it": "*",
     "@types/mime": "^2.0.1",
     "decompress": "^4.2.1",
     "escape-html": "^1.0.3",
@@ -35,7 +34,6 @@
     "jsonc-parser": "^2.2.0",
     "lodash.clonedeep": "^4.5.0",
     "macaddress": "^0.2.9",
-    "markdown-it": "^8.4.0",
     "mime": "^2.4.4",
     "ps-tree": "^1.2.0",
     "request": "^2.82.0",

packages/plugin-ext/src/main/browser/view/tree-view-widget.tsx

@@ -42,7 +42,7 @@ import { MessageService } from '@theia/core/lib/common/message-service';
 import { View } from '../../../common/plugin-protocol';
 import CoreURI from '@theia/core/lib/common/uri';
 import { ContextKeyService } from '@theia/core/lib/browser/context-key-service';
-import * as markdownit from 'markdown-it';
+import * as markdownit from '@theia/core/shared/markdown-it';
 import { isMarkdownString } from '../../../plugin/markdown-string';
 
 export const TREE_NODE_HYPERLINK = 'theia-TreeNodeHyperlink';

packages/preferences/package.json

@@ -10,8 +10,7 @@
     "@theia/userstorage": "1.21.0",
     "@theia/workspace": "1.21.0",
     "async-mutex": "^0.3.1",
-    "jsonc-parser": "^2.2.0",
-    "markdown-it": "^8.4.0"
+    "jsonc-parser": "^2.2.0"
   },
   "publishConfig": {
     "access": "public"

packages/preferences/src/browser/views/components/preference-node-renderer.ts

@@ -28,7 +28,7 @@ import debounce = require('@theia/core/shared/lodash.debounce');
 import { PreferenceTreeModel } from '../../preference-tree-model';
 import { PreferencesSearchbarWidget } from '../preference-searchbar-widget';
 import { WindowService } from '@theia/core/lib/browser/window/window-service';
-import * as markdownit from 'markdown-it';
+import * as markdownit from '@theia/core/shared/markdown-it';
 import * as DOMPurify from '@theia/core/shared/dompurify';
 import URI from '@theia/core/lib/common/uri';