From 6ad6e18d53794145bd027df78513d625073f10e6 Mon Sep 17 00:00:00 2001 From: "courtmanr@gmail.com" Date: Wed, 30 Sep 2026 20:45:07 +0100 Subject: [PATCH] Raise brace-expansion and DOMPurify past current advisories GHSA-q2hr-2g5m-vwhr (brace-expansion quadratic {a},b} rewrite, below 1.1.21 and 4.0.0-5.0.11) fails the required frontend dependency audit on every pull request. Move the locked copies to 1.1.21 and 5.0.12, and DOMPurify from 3.4.15 to 3.4.16 for GHSA-p98j-92pf-mc4p (IN_PLACE afterSanitize hook XSS). Lockfile only; the dependency security floors move with it. --- .../subsystems/deployment-installability.md | 17 +++++++++++ frontend-modern/package-lock.json | 30 +++++++++---------- .../__tests__/dependencySecurity.test.ts | 8 +++-- 3 files changed, 37 insertions(+), 18 deletions(-) diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 25b94cd236..0c3ed83fe3 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -2674,6 +2674,23 @@ parity is unchanged. `frontend-modern/src/security/__tests__/dependencySecurity.test.ts` pins the manifest ranges and locked floors so a later downgrade is rejected. +### Reviewed brace-expansion and DOMPurify advisory floors (30 Sep 2026) + +`frontend-modern/package-lock.json` moves every locked `brace-expansion` copy +to 1.1.21 or 5.0.12 for `GHSA-q2hr-2g5m-vwhr` (quadratic `{a},b}` rewrite CPU +denial of service, affecting below 1.1.21 and 4.0.0 to 5.0.11), which failed +the required frontend dependency audit on every pull request. `brace-expansion` +is reached only through build and lint tooling. The locked `dompurify` moves +from 3.4.15 to 3.4.16 for `GHSA-p98j-92pf-mc4p` (an `IN_PLACE` `afterSanitize` +hook that removes a node could leave detached event handlers armed, affecting +3.4.13 to 3.4.15). DOMPurify ships in the frontend bundle, and the change is a +patch release inside the reviewed `^3` range. The change is lockfile only, with +no manifest range change, and leaves the installer, artifact, signing, +promotion and rollback boundary unchanged. +`frontend-modern/src/security/__tests__/dependencySecurity.test.ts` raises the +`brace-expansion` floors to 1.1.21 and 5.0.12 and the reviewed `dompurify` +floor to 3.4.16, so a later downgrade is rejected. + ### Reviewed @types/node 26.6.2 refresh The 2026-09-23 `npm-minor-patch` group (Dependabot #2189) advances the diff --git a/frontend-modern/package-lock.json b/frontend-modern/package-lock.json index c80c78c109..b7fa03015b 100644 --- a/frontend-modern/package-lock.json +++ b/frontend-modern/package-lock.json @@ -1015,9 +1015,9 @@ "license": "MIT" }, "node_modules/@eslint/config-array/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -1096,9 +1096,9 @@ "license": "MIT" }, "node_modules/@eslint/eslintrc/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -2770,9 +2770,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { @@ -3284,9 +3284,9 @@ "license": "MIT" }, "node_modules/dompurify": { - "version": "3.4.15", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz", - "integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==", + "version": "3.4.16", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz", + "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -3600,9 +3600,9 @@ "license": "MIT" }, "node_modules/eslint/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/frontend-modern/src/security/__tests__/dependencySecurity.test.ts b/frontend-modern/src/security/__tests__/dependencySecurity.test.ts index d69d08533e..34c97754e5 100644 --- a/frontend-modern/src/security/__tests__/dependencySecurity.test.ts +++ b/frontend-modern/src/security/__tests__/dependencySecurity.test.ts @@ -54,10 +54,11 @@ const lockedVersions = (packageName: string): string[] => const braceExpansionIsPatched = (version: string): boolean => { const [major] = parseVersion(version); - if (major === 1) return atLeast(version, [1, 1, 18]); + // GHSA-q2hr-2g5m-vwhr (quadratic {a},b} rewrite) is fixed in 1.1.21 and 5.0.12. + if (major === 1) return atLeast(version, [1, 1, 21]); if (major === 2) return atLeast(version, [2, 1, 4]); if (major === 3) return atLeast(version, [3, 0, 6]); - return major >= 5 && atLeast(version, [5, 0, 9]); + return major >= 5 && atLeast(version, [5, 0, 12]); }; const nanoidIsPatched = (version: string): boolean => { @@ -178,7 +179,8 @@ describe('frontend dependency security floors', () => { // downgrade is rejected. The 2026-09-23 refresh raises @types/node to // 26.6.2 in frontend-modern and tests/integration. const floors: Array<[string, [number, number, number]]> = [ - ['dompurify', [3, 4, 15]], + // GHSA-p98j-92pf-mc4p (IN_PLACE afterSanitize hook XSS) affects 3.4.13-3.4.15. + ['dompurify', [3, 4, 16]], ['highlight.js', [11, 12, 0]], ['solid-js', [1, 9, 15]], ['@types/node', [26, 6, 2]],