pandoc.cabal | 72 41 + 31 - 0 !
src/Text/Pandoc/App/CommandLineOptions.hs | 4 2 + 2 - 0 !
2 files changed, 43 insertions(+), 33 deletions(-)

 revert dependency on base-noprelude

data/dzslides/template.html | 9 3 + 6 - 0 !
data/templates/default.dzslides | 5 1 + 4 - 0 !
data/templates/default.html5 | 3 0 + 3 - 0 !
src/Text/Pandoc/Options.hs | 4 2 + 2 - 0 !
test/lhs-test.html | 3 0 + 3 - 0 !
test/lhs-test.html+lhs | 3 0 + 3 - 0 !
test/s5-fancy.html | 2 1 + 1 - 0 !
test/writer.html5 | 3 0 + 3 - 0 !
8 files changed, 7 insertions(+), 25 deletions(-)

 avoid potential privacy breaches in templates

src/Text/Pandoc/Error.hs | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 improve error message when pdf program is missing

pandoc.cabal | 4 2 + 2 - 0 !
stack.yaml | 4 2 + 2 - 0 !
test/command/5627.md | 8 4 + 4 - 0 !
test/command/5650.md | 8 4 + 4 - 0 !
test/lhs-test.html | 6 3 + 3 - 0 !
test/lhs-test.html+lhs | 6 3 + 3 - 0 !
6 files changed, 18 insertions(+), 18 deletions(-)

 use latest skylighting.

This adds `aria-hidden="true"` to the empty a elements, which
helps people who use screen readers.

pandoc.cabal | 1 1 + 0 - 0 !
src/Text/Pandoc/Class/PandocIO.hs | 12 6 + 6 - 0 !
src/Text/Pandoc/Class/PandocMonad.hs | 2 1 + 1 - 0 !
test/Tests/MediaBag.hs | 37 37 + 0 - 0 !
test/test-pandoc.hs | 2 2 + 0 - 0 !
5 files changed, 47 insertions(+), 7 deletions(-)

 fix a security vulnerability in mediabag and
 T.P.Class.IO.writeMedia.

This vulnerability, discovered by Entroy C, allows users to write
arbitrary files to any location by feeding pandoc a specially crafted
URL in an image element.  The vulnerability is serious for anyone
using pandoc to process untrusted input.

src/Text/Pandoc/Class/PandocMonad.hs | 10 5 + 5 - 0 !
test/Tests/MediaBag.hs | 12 11 + 1 - 0 !
2 files changed, 16 insertions(+), 6 deletions(-)

 fix new variant of the vulnerability in cve-2023-35936.

Guilhem Moulin noticed that the fix to CVE-2023-35936 was incomplete.
An attacker could get around it by double-encoding the malicious
extension to create or override arbitrary files.

    $ echo '![](data://image/png;base64,cHJpbnQgImhlbGxvIgo=;.lua+%252f%252e%252e%252f%252e%252e%252fb%252elua)' >b.md
    $ .cabal/bin/pandoc b.md --extract-media=bar
    <p><img
    src="bar/2a0eaa89f43fada3e6c577beea4f2f8f53ab6a1d.lua+%2f%2e%2e%2f%2e%2e%2fb%2elua" /></p>
    $ cat b.lua
    print "hello"
    $ find bar
    bar/
    bar/2a0eaa89f43fada3e6c577beea4f2f8f53ab6a1d.lua+

This commit adds a test case for this more complex attack and fixes
the vulnerability.