Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .copyrightconfig
Original file line number Diff line number Diff line change
Expand Up @@ -11,4 +11,4 @@ startyear: 2015
# - Dotfiles already skipped automatically
# Enable by removing the leading '# ' from the next line and editing values.
# filesexcluded: third_party/*, docs/generated/*.md, assets/*.png, scripts/temp_*.py, vendor/lib.js
filesexcluded: .github/*, README.md, Jenkinsfile, package.json, package-lock.json, test-app/*, *.md, docker-compose.yaml, test-complete-app-mlDeploy/*
filesexcluded: .github/*, README.md, Jenkinsfile, test-app/*, *.md, docker-compose.yaml, test-complete-app-mlDeploy/*, *.json
34 changes: 10 additions & 24 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,16 @@ or
There are also tests in the `test-complete` folder. The setup for these is more complicated and can
be found in the `Jenkinsfile` file in this repository in the `runE2ETests` function.

## Generating documentation

After installing the project dependencies, you can build the reference documentation locally from the root
directory of the marklogic package:

npm run doc

The documentation is generated in the `./doc` gitignored directory. The documentation can also be
accessed online at <https://docs.marklogic.com/jsdoc/index.html>.

## Explanation of overrides in package.json

Each override is being documented here so we have some ability in the future to remove an override as needed.
Expand Down Expand Up @@ -86,30 +96,12 @@ glob-parent: "6.0.2"
- Why needed: Older versions vulnerable to regex attacks
- CVE/Issue: CVE-2020-28469 - ReDoS vulnerability

jsdoc: "4.0.0"
- Purpose: Fixes high-severity data access vulnerability in older jsdoc versions
- Affects: gulp-jsdoc3 → jsdoc
- Why needed: [email protected] uses older jsdoc with known vulnerabilities
- CVE/Issue: High severity vulnerability in taffydb (jsdoc dependency)

markdown-it: "14.1.0"
- Purpose: Use latest markdown parser for JSDoc
- Affects: gulp-jsdoc3 → jsdoc → markdown-it
- Why needed: Latest version (no vulnerabilities), handles RFC 7464 parsing
- Note: No newer version available, ensures consistency

minimatch: "5.1.0"
- Purpose: Fixes ReDoS (Regular Expression Denial of Service) vulnerability
- Affects: mocha, gulp-mocha, and other build tools
- Why needed: Older minimatch versions have catastrophic backtracking vulnerability
- CVE/Issue: CVE-2022-3517 - ReDoS vulnerability

sanitize-html: "2.17.0"
- Purpose: Ensure JSDoc template uses non-vulnerable HTML sanitizer
- Affects: gulp-jsdoc3 → ink-docstrap → sanitize-html
- Why needed: Older versions have XSS vulnerabilities
- Note: Also in devDependencies, override ensures transitive deps use safe version

semver: "7.5.3"
- Purpose: Fixes ReDoS in version parsing
- Affects: Multiple packages across dependency tree
Expand All @@ -122,12 +114,6 @@ tar-fs: "2.1.4"
- Why needed: Older tar-fs allows extracting files outside intended directory
- CVE/Issue: CVE-2024-28861 - Path traversal

tmp: "0.2.4"
- Purpose: Fixes arbitrary file write vulnerability
- Affects: gulp-jsdoc3 → jsdoc → tmp
- Why needed: Older tmp versions have file system security issues
- CVE/Issue: CVE-2024-28858 - Arbitrary file write

The following are related to this npm supply chain attack - https://orca.security/resources/blog/qix-npm-attack/ .

ansi-styles: "4.3.0"
Expand Down
11 changes: 0 additions & 11 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -98,17 +98,6 @@ in the online resources. To run the examples, follow the instructions here:

examples/1readme.txt

### Generating Documentation Locally

After installing the project dependencies (including the [gulp](http://gulpjs.com/)
build system), you can build the reference documentation locally from the root
directory of the marklogic package:

npm run doc

The documentation is generated in a doc subdirectory. The documentation can also be
accessed online [here](https://docs.marklogic.com/jsdoc/index.html).

## Support

The MarkLogic Node.js Client API is maintained by MarkLogic Engineering.
Expand Down
10 changes: 0 additions & 10 deletions gulpfile.js
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ const path = require('path');
const gulp = require('gulp');
const eslint = require('gulp-eslint-new');
const mocha = require('gulp-mocha');
const jsdoc = require('gulp-jsdoc3');

const { parallel, series } = gulp;

Expand Down Expand Up @@ -33,14 +32,6 @@ function test() {
}));
}

function doc() {
// TODO: clear the directory first - maybe by following this recipe:
// https://github.com/gulpjs/gulp/blob/master/docs/recipes/delete-files-folder.md
const config = require('./jsdoc.json');
return gulp.src(['./lib/*.js', 'README.md'])
.pipe(jsdoc(config));
}

let testModulesClient = null;
function getTestModulesClient() {
if (testModulesClient === null) {
Expand Down Expand Up @@ -184,7 +175,6 @@ function runProxyTests() {
}));
}

exports.doc = doc;
exports.lint = lint;
exports.loadProxyTests = series(parallel(loadProxyTestInspector, loadProxyTestData, loadProxyTestCases), updateMjsFiles);
exports.generateProxyTests = parallel(positiveProxyTests, negativeProxyTests, generatedProxyTests);
Expand Down
2 changes: 1 addition & 1 deletion jsdoc.json
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"templates": {
"theme": "marklogic",
"systemName": "MarkLogic Node.js Client API",
"copyright": "Copyright (c) 2020 MarkLogic Corporation",
"copyright": "Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.",
"navType": "vertical",
"inverseNav": true,
"includeDate": false,
Expand Down
Loading