gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-23 20:25:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Raise brace-expansion and DOMPurify past current advisories (#2349)

Browse Source 
GHSA-q2hr-2g5m-vwhr in brace-expansion (below 1.1.21, and 4.0.0 to
5.0.11) fails the required frontend dependency audit on every PR. This
moves the locked copies to 1.1.21 and 5.0.12, and DOMPurify from 3.4.15
to 3.4.16 for GHSA-p98j-92pf-mc4p. Lockfile only, with the dependency
security floors and installability contract updated to match.
This commit is contained in:
rcourtman
2026-09-30 22:25:16 +01:00
committed by GitHub
parent fa1d9eb36d 6ad6e18d53
commit 8d5969fb3b
3 changed files with 37 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/release-control/v6/internal/subsystems/deployment-installability.md
+17
View File
@@ -2674,6 +2674,23 @@ parity is unchanged.
`frontend-modern/src/security/__tests__/dependencySecurity.test.ts` pins the
manifest ranges and locked floors so a later downgrade is rejected.
### Reviewed brace-expansion and DOMPurify advisory floors (30 Sep 2026)
`frontend-modern/package-lock.json` moves every locked `brace-expansion` copy
to 1.1.21 or 5.0.12 for `GHSA-q2hr-2g5m-vwhr` (quadratic `{a},b}` rewrite CPU
denial of service, affecting below 1.1.21 and 4.0.0 to 5.0.11), which failed
the required frontend dependency audit on every pull request. `brace-expansion`
is reached only through build and lint tooling. The locked `dompurify` moves
from 3.4.15 to 3.4.16 for `GHSA-p98j-92pf-mc4p` (an `IN_PLACE` `afterSanitize`
hook that removes a node could leave detached event handlers armed, affecting
3.4.13 to 3.4.15). DOMPurify ships in the frontend bundle, and the change is a
patch release inside the reviewed `^3` range. The change is lockfile only, with
no manifest range change, and leaves the installer, artifact, signing,
promotion and rollback boundary unchanged.
`frontend-modern/src/security/__tests__/dependencySecurity.test.ts` raises the
`brace-expansion` floors to 1.1.21 and 5.0.12 and the reviewed `dompurify`
floor to 3.4.16, so a later downgrade is rejected.
### Reviewed @types/node 26.6.2 refresh
The 2026-09-23 `npm-minor-patch` group (Dependabot #2189) advances the
frontend-modern/package-lock.json
Generated
+15 -15
View File
@@ -1015,9 +1015,9 @@
"license": "MIT"
},
"node_modules/@eslint/config-array/node_modules/brace-expansion": {
"version": "1.1.18",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
"integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"version": "1.1.21",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
"integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -1096,9 +1096,9 @@
"license": "MIT"
},
"node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
"version": "1.1.18",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
"integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"version": "1.1.21",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
"integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -2770,9 +2770,9 @@
}
},
"node_modules/brace-expansion": {
"version": "5.0.9",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
"integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
"version": "5.0.12",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
"integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -3284,9 +3284,9 @@
"license": "MIT"
},
"node_modules/dompurify": {
"version": "3.4.15",
"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz",
"integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==",
"version": "3.4.16",
"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz",
"integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==",
"license": "(MPL-2.0 OR Apache-2.0)",
"optionalDependencies": {
"@types/trusted-types": "^2.0.7"
@@ -3600,9 +3600,9 @@
"license": "MIT"
},
"node_modules/eslint/node_modules/brace-expansion": {
"version": "1.1.18",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
"integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"version": "1.1.21",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
"integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
"dev": true,
"license": "MIT",
"dependencies": {
frontend-modern/src/security/__tests__/dependencySecurity.test.ts
+5 -3
View File
@@ -54,10 +54,11 @@ const lockedVersions = (packageName: string): string[] =>
const braceExpansionIsPatched = (version: string): boolean => {
const [major] = parseVersion(version);
if (major === 1) return atLeast(version, [1, 1, 18]);
// GHSA-q2hr-2g5m-vwhr (quadratic {a},b} rewrite) is fixed in 1.1.21 and 5.0.12.
if (major === 1) return atLeast(version, [1, 1, 21]);
if (major === 2) return atLeast(version, [2, 1, 4]);
if (major === 3) return atLeast(version, [3, 0, 6]);
return major >= 5 && atLeast(version, [5, 0, 9]);
return major >= 5 && atLeast(version, [5, 0, 12]);
};
const nanoidIsPatched = (version: string): boolean => {
@@ -178,7 +179,8 @@ describe('frontend dependency security floors', () => {
// downgrade is rejected. The 2026-09-23 refresh raises @types/node to
// 26.6.2 in frontend-modern and tests/integration.
const floors: Array<[string, [number, number, number]]> = [
['dompurify', [3, 4, 15]],
// GHSA-p98j-92pf-mc4p (IN_PLACE afterSanitize hook XSS) affects 3.4.13-3.4.15.
['dompurify', [3, 4, 16]],
['highlight.js', [11, 12, 0]],
['solid-js', [1, 9, 15]],
['@types/node', [26, 6, 2]],