@sap/cds-dk 10.1.1 → 10.1.2

package/node_modules/@sap/cds/libx/queue/index.js

@@ -132,7 +132,7 @@ const _processTasks = (target, tenant, _opts = {}) => {
 
       if (opts.maxAttempts) tasksQuery.where({ attempts: { '<': opts.maxAttempts } })
       if (opts.parallel) {
-        tasksQuery.SELECT.forUpdate.ignoreLocked = true
+        tasksQuery.forUpdate({ ignoreLocked: true })
         const shifted = new Date(Math.max(0, currTime - _timeout)).toISOString()
         tasksQuery.where({ status: null, or: { lastAttemptTimestamp: { '<': shifted } } })
         // Note: If there are messages which are not yet timed out, but will hang eventually,
@@ -215,8 +215,14 @@ const _processTasks = (target, tenant, _opts = {}) => {
           const user = new cds.User.Privileged(userId)
           context.user = user
 
-          // The latter is for backwards compatibility where `service` was not stored and `target` was the service name
-          const srvName = _msg.service || _task.target
+          // older messages have no `service`; the name is encoded in `target` as
+          // `<targetPrefix><serviceName>` (see utils.targetName)
+          let srvName = _msg.service
+          if (!srvName) {
+            srvName = _task.target
+            if (opts.targetPrefix && srvName.startsWith(opts.targetPrefix))
+              srvName = srvName.slice(opts.targetPrefix.length)
+          }
           delete _msg.service
 
           const fromSend = _msg._fromSend
@@ -227,6 +233,7 @@ const _processTasks = (target, tenant, _opts = {}) => {
 
           const task = {
             ID: _task.ID,
+            timestamp: _task.timestamp,
             msg,
             context,
             srvName,
@@ -246,6 +253,19 @@ const _processTasks = (target, tenant, _opts = {}) => {
       let minAttemptFailed
       try {
         const _handleWithErr = async task => {
+          if (!cds.services[task.srvName]) {
+            // service not served/registered: unrecoverable, so dead-letter it (attempts -> maxAttempts)
+            // instead of crashing the app or blocking the queue
+            LOG.error(`No service '${task.srvName}' found for a queued message; treating as unrecoverable.`)
+            if (!minAttemptFailed) minAttemptFailed = task.attempts
+            else minAttemptFailed = Math.min(minAttemptFailed, task.attempts)
+            task[$error] = new Error(`No service '${task.srvName}' found`)
+            if (opts.maxAttempts) {
+              task.updateData = { attempts: opts.maxAttempts }
+              toBeUpdated.push(task)
+            } else toBeDeleted.push(task)
+            return
+          }
           const service = cds.unqueued(await cds.connect.to(task.srvName))
           try {
             if (task.msg.query) {
@@ -264,9 +284,21 @@ const _processTasks = (target, tenant, _opts = {}) => {
               // we can only delete in the current tx if legacyLocking (i.e., long-lasting db locks) is false
               if (!opts.legacyLocking) {
                 const _delete = DELETE.from(tasksEntity).where({ ID: task.ID })
-                // only delete singleton task if not modified in the meantime
-                if (task.msg.queue?.task) _delete.where({ timestamp: { '<': _timestampPlusOneMS(task.msg.timestamp) } })
-                await _delete
+                // guard on the selected row's timestamp (not `task.msg.timestamp`: `timestamp` is in
+                // `_ignoredContext`, absent from the msg, and reads back as `now`)
+                if (task.msg.queue?.task)
+                  _delete.where({ timestamp: { '<': _timestampPlusOneMS(new Date(task.timestamp)) } })
+                const _deleted = await _delete
+                const _cnt = typeof _deleted === 'number' ? _deleted : (_deleted?.affected ?? 0)
+                // recreate the next occurrence in the same tx; skip if the guarded delete removed nothing
+                // (the singleton was unscheduled/rescheduled concurrently)
+                if (task.msg.queue?.every && (!task.msg.queue?.task || _cnt > 0)) {
+                  const _m = { ...task.msg }
+                  _m._fromSend = task.msg instanceof cds.Request
+                  await INSERT.into(tasksEntity).entries(create_task(target, _m, task.context, task.srvName, opts, true))
+                  // re-trigger the drain to schedule the new occurrence
+                  _setWaitingTime(0)
+                }
               }
               return result
             })
@@ -353,7 +385,7 @@ const _processTasks = (target, tenant, _opts = {}) => {
         if (each.updateData.lastError && typeof each.updateData.lastError !== 'string') {
           each.updateData.lastError = inspect(each.updateData.lastError)
         }
-        each.updateData.lastAttemptTimestamp = cds.context.timestamp
+        each.updateData.lastAttemptTimestamp = cds.context?.timestamp ?? new Date()
         queries.push(UPDATE(tasksEntity).where({ ID: each.ID }).set(each.updateData))
       }
 
@@ -409,11 +441,11 @@ const _processTasks = (target, tenant, _opts = {}) => {
           }
         }
 
-        // handle `every`
-        if (task.msg.queue?.every) {
+        // handle `every` — !legacyLocking recreates in the success tx above; the legacyLocking path
+        // (deferred delete) recreates here, using a read-back to detect a concurrent unschedule/reschedule
+        if (task.msg.queue?.every && opts.legacyLocking) {
           const _m = { ...task.msg }
           if (task.msg.queue.task) {
-            // Read from database as the singleton task might have been modified/deleted in the meantime
             const dbTask = await SELECT.one(tasksEntity).where({ ID: task.ID })
             if (!dbTask) continue //> was unscheduled -> no next occurrence
             Object.assign(_m, JSON.parse(dbTask.msg))
@@ -425,6 +457,8 @@ const _processTasks = (target, tenant, _opts = {}) => {
       }
       // invoke failed handlers (only if max attempts is reached)
       for (const task of toBeUpdated) {
+        // skip dead-lettered messages whose service is not served/registered (see above)
+        if (!cds.services[task.srvName]) continue
         if (
           !task.msg.event.endsWith('/#succeeded') &&
           !task.msg.event.endsWith('/#failed') &&

package/node_modules/@sap/cds/libx/queue/processing.js

@@ -25,10 +25,15 @@ const $service = Symbol('service')
 const MAX_WAITING_TIME = 1480000
 const CAPATTEMPTS = Math.ceil(Math.log(MAX_WAITING_TIME / 1000 + 1) / Math.log(1.5))
 
+const _timestampPlusOneMS = ts => new Date(ts.getTime() + 1).toISOString()
+
 let _processableTasksQuery = {}
 
-const _addParamFalse = w => {
-  if (w.xpr) return w.xpr.map(xpr => _addParamFalse(xpr))
+const _inlineLiterals = w => {
+  if (w.xpr) return w.xpr.map(xpr => _inlineLiterals(xpr))
+  // also recurse into function args (e.g. `startswith(target, '<appid>')`) so a literal arg isn't
+  // bound as a `?` and shift the positional binding of the query's real params
+  if (w.args) return (Array.isArray(w.args) ? w.args : Object.values(w.args)).map(a => _inlineLiterals(a))
   if (w.val === undefined) return w
   w.param = false
   return w
@@ -50,9 +55,14 @@ const _getProcessableTasksQuery = ({ maxAttempts, chunkSize }, queueName) => {
 
   const appid = cds.env.appid
 
+  // also match pre-`appid` rows: `appid IS NULL` with `target` starting with `appid` (the former app prefix)
+  const targetCondition = appid
+    ? `(appid = '${appid}' AND target = '${queueName}') OR (appid IS NULL AND startswith(target, '${appid}') = true)`
+    : `target = '${queueName}'`
+
   const sql = `
     SELECT ID FROM ${entity.name}
-    WHERE ${appid ? `appid = '${appid}' AND ` : ''}target = '${queueName}'
+    WHERE (${targetCondition})
       AND attempts < ${maxAttempts}
       AND (status is NULL OR lastAttemptTimestamp < ?)
       AND (${attemptConditions.join(' OR ')})
@@ -61,10 +71,9 @@ const _getProcessableTasksQuery = ({ maxAttempts, chunkSize }, queueName) => {
 
   _processableTasksQuery[queueName] = cds.ql(sql)
   _processableTasksQuery[queueName].SELECT.limit.rows.param = false
-  _processableTasksQuery[queueName].SELECT.where.map(w => _addParamFalse(w))
+  _processableTasksQuery[queueName].SELECT.where.map(w => _inlineLiterals(w))
   _processableTasksQuery[queueName].SELECT.columns = Object.keys(entity.elements).map(k => ({ ref: [k] }))
-  _processableTasksQuery[queueName].forUpdate()
-  _processableTasksQuery[queueName].SELECT.forUpdate.ignoreLocked = true
+  _processableTasksQuery[queueName].forUpdate({ ignoreLocked: true })
 
   return _processableTasksQuery[queueName]
 }
@@ -101,10 +110,9 @@ const _getFlushTasksQuery = ({ maxAttempts, chunkSize }, queueName) => {
       ORDER BY timestamp ASC, ID ASC
       LIMIT ${chunkSize}`)
     _flushTasksQuery[queueName].SELECT.limit.rows.param = false
-    _flushTasksQuery[queueName].SELECT.where.map(w => _addParamFalse(w))
+    _flushTasksQuery[queueName].SELECT.where.map(w => _inlineLiterals(w))
     _flushTasksQuery[queueName].SELECT.columns = Object.keys(entity.elements).map(k => ({ ref: [k] }))
-    _flushTasksQuery[queueName].forUpdate()
-    _flushTasksQuery[queueName].SELECT.forUpdate.ignoreLocked = true
+    _flushTasksQuery[queueName].forUpdate({ ignoreLocked: true })
   }
   return _flushTasksQuery[queueName]
 }
@@ -257,8 +265,13 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
           const user = new cds.User.Privileged(userId)
           context.user = user
 
-          // The latter is for backwards compatibility where `service` was not stored and `target` was the service name
-          const srvName = _msg.service || _task.target
+          // older messages have no `service`; the name is encoded in `target` as `<appid><serviceName>`
+          let srvName = _msg.service
+          if (!srvName) {
+            srvName = _task.target
+            const appid = cds.env.appid
+            if (appid && srvName.startsWith(appid)) srvName = srvName.slice(appid.length)
+          }
           delete _msg.service
 
           const fromSend = _msg._fromSend
@@ -301,6 +314,15 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
 
       try {
         const _handleWithErr = async task => {
+          if (!cds.services[task.srvName]) {
+            // service not served/registered: unrecoverable, so dead-letter it (attempts -> maxAttempts)
+            // instead of crashing the app or blocking the queue
+            LOG.error(`No service '${task.srvName}' found for a queued message; treating as unrecoverable.`)
+            task[$error] = new Error(`No service '${task.srvName}' found`)
+            task.updateData = { attempts: opts.maxAttempts }
+            toBeUpdated.push(task)
+            return
+          }
           const service = cds.unqueued(await cds.connect.to(task.srvName))
           try {
             if (task.msg.query) {
@@ -330,12 +352,18 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
                   .where({ msg: { like: `%"tenant":"${task.msg.data.tenant}"%` } })
                   .where({ msg: { like: `%"target":"${task.msg.data.target}"%` } })
               } else {
-                await DELETE.from(OUTBOX).where({ ID: task.ID })
+                const _delete = DELETE.from(OUTBOX).where({ ID: task.ID })
+                // guard on the selected row's timestamp so a concurrent unschedule/reschedule is
+                // serialized against the recurrence recreated below
+                if (task.msg.queue?.task)
+                  _delete.where({ timestamp: { '<': _timestampPlusOneMS(new Date(task._task.timestamp)) } })
+                const _deleted = await _delete
+                const _cnt = typeof _deleted === 'number' ? _deleted : (_deleted?.affected ?? 0)
 
                 // For atomicity: create follow-up tasks in same transaction as delete
                 const follow_ups = []
 
-                // #succeeded callback (only if not already a callback event)
+                // #succeeded callback — always owed once the in-flight execution completed
                 if (!task.msg.event.endsWith('/#succeeded') && !task.msg.event.endsWith('/#failed')) {
                   const succeededMsg = _newMsgForCallbackFrom(task.msg)
                   succeededMsg.event = succeededMsg.event + '/#succeeded'
@@ -352,8 +380,9 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
                   }
                 }
 
-                // Next recurrence for .every() tasks
-                if (task.msg.queue?.every) {
+                // next occurrence — only if the guarded delete removed the row (else it was unscheduled/
+                // rescheduled concurrently); non-singletons always recreate
+                if (task.msg.queue?.every && (!task.msg.queue?.task || _cnt > 0)) {
                   const _m = { ...task.msg }
                   _m._fromSend = task.msg instanceof cds.Request
                   const next_iteration_task = create_task(queueName, _m, task.context, task.srvName, opts, true)
@@ -423,7 +452,7 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
             if (each.updateData.lastError && typeof each.updateData.lastError !== 'string') {
               each.updateData.lastError = inspect(each.updateData.lastError)
             }
-            each.updateData.lastAttemptTimestamp = cds.context.timestamp
+            each.updateData.lastAttemptTimestamp = cds.context?.timestamp ?? new Date().toISOString()
             follow_up_tasks.push(Object.assign({}, each._task, each.updateData))
             afters.add(waitingTime(each.updateData.attempts))
           }
@@ -441,6 +470,8 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
 
           // Create #failed callbacks (only if max attempts is reached)
           for (const task of toBeUpdated) {
+            // skip dead-lettered messages whose service is not served/registered (see above)
+            if (!cds.services[task.srvName]) continue
             if (
               !is_t0 &&
               !task.msg.event.endsWith('/#succeeded') &&

package/node_modules/@sap/cds/libx/queue/utils.js

@@ -51,6 +51,9 @@ const create_task = (queueName, msg, context, serviceName, queueOpts, reoccurren
     appid: cds.env.appid,
     target: cds.env.appid ? queueName : targetName(queueName, queueOpts),
     timestamp,
+    // reset status so re-submitting a task that is currently being processed (UPSERT over its
+    // 'processing' row) yields a processable row again instead of a stuck one
+    status: null,
     msg: JSON.stringify(_msg)
   }
 

package/node_modules/@sap/cds/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "10.1.0",
+  "version": "10.1.1",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/node_modules/@sap/cds/tasks/enterprise-messaging-deploy.js

@@ -19,11 +19,19 @@ const xsuaaSrv = Object.keys(vcap_services)
 if (!xsuaaSrv)
   throw new Error('You need to provide credentials of service `XSUAA` in environment variable `VCAP_SERVICES`')
 const tokenStore = {}
-const oa2 = {
-  client: xsuaaSrv.credentials.clientid,
-  secret: xsuaaSrv.credentials.clientsecret,
-  endpoint: xsuaaSrv.credentials.url
-}
+const xsuaaCreds = xsuaaSrv.credentials
+const oa2 =
+  xsuaaCreds['credential-type'] === 'x509'
+    ? {
+        client: xsuaaCreds.clientid,
+        endpoint: xsuaaCreds.certurl,
+        mTLS: { cert: xsuaaCreds.certificate, key: xsuaaCreds.key }
+      }
+    : {
+        client: xsuaaCreds.clientid,
+        secret: xsuaaCreds.clientsecret,
+        endpoint: xsuaaCreds.url
+      }
 
 const main = async () => {
   // use authorizedRequest to fire against deploy endpoint

package/node_modules/proxy-addr/HISTORY.md

@@ -1,144 +1,150 @@
-2.0.7 / 2021-05-31
-==================
+2.0.8
+=====
+
+  * Fix [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) ([GHSA-jqcg-44mw-7w3h](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h))
+
+
+2.0.7
+=====
 
   * deps: forwarded@0.2.0
     - Use `req.socket` over deprecated `req.connection`
 
-2.0.6 / 2020-02-24
-==================
+2.0.6
+=====
 
   * deps: ipaddr.js@1.9.1
 
-2.0.5 / 2019-04-16
-==================
+2.0.5
+=====
 
   * deps: ipaddr.js@1.9.0
 
-2.0.4 / 2018-07-26
-==================
+2.0.4
+=====
 
   * deps: ipaddr.js@1.8.0
 
-2.0.3 / 2018-02-19
-==================
+2.0.3
+=====
 
   * deps: ipaddr.js@1.6.0
 
-2.0.2 / 2017-09-24
-==================
+2.0.2
+=====
 
   * deps: forwarded@~0.1.2
     - perf: improve header parsing
     - perf: reduce overhead when no `X-Forwarded-For` header
 
-2.0.1 / 2017-09-10
-==================
+2.0.1
+=====
 
   * deps: forwarded@~0.1.1
     - Fix trimming leading / trailing OWS
     - perf: hoist regular expression
   * deps: ipaddr.js@1.5.2
 
-2.0.0 / 2017-08-08
-==================
+2.0.0
+=====
 
   * Drop support for Node.js below 0.10
 
-1.1.5 / 2017-07-25
-==================
+1.1.5
+=====
 
   * Fix array argument being altered
   * deps: ipaddr.js@1.4.0
 
-1.1.4 / 2017-03-24
-==================
+1.1.4
+=====
 
   * deps: ipaddr.js@1.3.0
 
-1.1.3 / 2017-01-14
-==================
+1.1.3
+=====
 
   * deps: ipaddr.js@1.2.0
 
-1.1.2 / 2016-05-29
-==================
+1.1.2
+=====
 
   * deps: ipaddr.js@1.1.1
     - Fix IPv6-mapped IPv4 validation edge cases
 
-1.1.1 / 2016-05-03
-==================
+1.1.1
+=====
 
   * Fix regression matching mixed versions against multiple subnets
 
-1.1.0 / 2016-05-01
-==================
+1.1.0
+=====
 
   * Fix accepting various invalid netmasks
     - IPv4 netmasks must be contingous
     - IPv6 addresses cannot be used as a netmask
   * deps: ipaddr.js@1.1.0
 
-1.0.10 / 2015-12-09
-===================
+1.0.10
+======
 
   * deps: ipaddr.js@1.0.5
     - Fix regression in `isValid` with non-string arguments
 
-1.0.9 / 2015-12-01
-==================
+1.0.9
+=====
 
   * deps: ipaddr.js@1.0.4
     - Fix accepting some invalid IPv6 addresses
     - Reject CIDRs with negative or overlong masks
   * perf: enable strict mode
 
-1.0.8 / 2015-05-10
-==================
+1.0.8
+=====
 
   * deps: ipaddr.js@1.0.1
 
-1.0.7 / 2015-03-16
-==================
+1.0.7
+=====
 
   * deps: ipaddr.js@0.1.9
     - Fix OOM on certain inputs to `isValid`
 
-1.0.6 / 2015-02-01
-==================
+1.0.6
+=====
 
   * deps: ipaddr.js@0.1.8
 
-1.0.5 / 2015-01-08
-==================
+1.0.5
+=====
 
   * deps: ipaddr.js@0.1.6
 
-1.0.4 / 2014-11-23
-==================
+1.0.4
+=====
 
   * deps: ipaddr.js@0.1.5
     - Fix edge cases with `isValid`
 
-1.0.3 / 2014-09-21
-==================
+1.0.3
+=====
 
   * Use `forwarded` npm module
 
-1.0.2 / 2014-09-18
-==================
+1.0.2
+=====
 
   * Fix a global leak when multiple subnets are trusted
   * Support Node.js 0.6
   * deps: ipaddr.js@0.1.3
 
-1.0.1 / 2014-06-03
-==================
+1.0.1
+=====
 
   * Fix links in npm package
 
-1.0.0 / 2014-05-08
-==================
+1.0.0
+=====
 
   * Add `trust` argument to determine proxy trust on
     * Accepts custom function
@@ -150,12 +156,12 @@
   * Add `proxyaddr.compile` to pre-compile `trust` function
     to make subsequent calls faster
 
-0.0.1 / 2014-05-04
-==================
+0.0.1
+=====
 
   * Fix bad npm publish
 
-0.0.0 / 2014-05-04
-==================
+0.0.0
+=====
 
   * Initial release

package/node_modules/proxy-addr/README.md

@@ -37,7 +37,7 @@ proxyaddr(req, function (addr) { return addr === '127.0.0.1' })
 proxyaddr(req, function (addr, i) { return i < 1 })
 ```
 
-The `trust` arugment may also be a single IP address string or an
+The `trust` argument may also be a single IP address string or an
 array of trusted addresses, as plain IP addresses, CIDR-formatted
 strings, or IP/netmask strings.
 

package/node_modules/proxy-addr/index.js

@@ -256,6 +256,13 @@ function trustMulti (subnets) {
     if (!isip(addr)) return false
 
     var ip = parseip(addr)
+
+    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+      // cannot bypass the cross-family guard via the same-family path
+      ip = ip.toIPv4Address()
+    }
+
     var ipconv
     var kind = ip.kind()
 
@@ -272,6 +279,12 @@ function trustMulti (subnets) {
           continue
         }
 
+        if (subnetkind !== 'ipv4' && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+          // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+          // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+          continue
+        }
+
         if (!ipconv) {
           // Convert IP to match subnet IP kind
           ipconv = subnetkind === 'ipv4'
@@ -280,6 +293,9 @@ function trustMulti (subnets) {
         }
 
         trusted = ipconv
+      } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+        // A native IPv6 candidate cannot match an IPv4-mapped subnet
+        continue
       }
 
       if (trusted.match(subnetip, subnetrange)) {
@@ -308,6 +324,13 @@ function trustSingle (subnet) {
     if (!isip(addr)) return false
 
     var ip = parseip(addr)
+
+    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+      // cannot bypass the cross-family guard via the same-family path
+      ip = ip.toIPv4Address()
+    }
+
     var kind = ip.kind()
 
     if (kind !== subnetkind) {
@@ -316,10 +339,19 @@ function trustSingle (subnet) {
         return false
       }
 
+      if (!subnetisipv4 && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+        // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+        // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+        return false
+      }
+
       // Convert IP to match subnet IP kind
       ip = subnetisipv4
         ? ip.toIPv4Address()
         : ip.toIPv4MappedAddress()
+    } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+      // A native IPv6 candidate cannot match an IPv4-mapped subnet
+      return false
     }
 
     return ip.match(subnetip, subnetrange)

package/node_modules/proxy-addr/package.json

@@ -1,7 +1,7 @@
 {
   "name": "proxy-addr",
   "description": "Determine address of proxied request",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
   "keywords": [
@@ -10,6 +10,10 @@
     "x-forwarded-for"
   ],
   "repository": "jshttp/proxy-addr",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
   "dependencies": {
     "forwarded": "0.2.0",
     "ipaddr.js": "1.9.1"
@@ -17,11 +21,11 @@
   "devDependencies": {
     "benchmark": "2.1.4",
     "beautify-benchmark": "0.2.4",
-    "deep-equal": "1.0.1",
+    "deep-equal": "1.1.2",
     "eslint": "7.26.0",
     "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.23.4",
-    "eslint-plugin-markdown": "2.2.0",
+    "eslint-plugin-import": "2.32.0",
+    "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
     "eslint-plugin-promise": "4.3.1",
     "eslint-plugin-standard": "4.1.0",