Bump mammoth from 1.12.0 to 1.13.0

[dependabot]

Bumps mammoth from 1.12.0 to 1.13.0.

Changelog

Sourced from mammoth's changelog.

1.13.0

• Replace the use of bluebird with native promises.

  This is arguably a breaking change: however, the return value of functions such as convertToHtml() was only documented as a promise, rather than as a bluebird promise.

  The only exception is that the docs previously used .done(): therefore, when returning promises from the API to external users, a done method is added.

  Any callers that rely on bluebird promises can convert the returned promise into a bluebird promise using bluebird.Promise.resolve().

• Read the children of w:customXml elements.

• Handle paragraphs and runs that have been moved and tracked as a revision.

• Improve escaping in Markdown writer. This avoids some cases where source documents could inject arbitrary HTML into the converted document.

1.12.3

• Avoid excessive backtracking when parsing an unterminated string with many escape sequences. The previous behaviour would allow maliciously crafted documents to cause a denial of service.

  Note that it is still strongly recommended to process untrusted documents in a separate thread with a timeout to avoid potential similar issues.

• Handle complex field separator and end characters without corresponding start characters.

1.12.2

• Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

1.12.1

• Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

• Detect and ignore numbering levels that use numStyleLink to refer to themselves.

Commits

• 791a189 Bump version to 1.13.0
• 4abdfe2 Clarify implication of markdown escaping
• 8e6e755 Escape markdown image alt text and src
• 9463f5c Escape markdown link hrefs
• d302d07 Escape HTML IDs in markdown writer
• 671dbb6 Handle paragraphs and runs that have been moved and tracked as a revision
• d157374 Read the children of w:customXml elements
• 2a489fb Mark up code fragment in README
• adc5749 Update dingbat-to-unicode to 1.0.2
• c0dce8c Remove dependency on path-is-absolute
• Additional commits viewable in compare view

[dependabot]

Superseded by #288.