From 94732c24ae0f69dd2aba2dede5813ff389290a32 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Wed, 22 Jul 2026 12:52:29 +0100 Subject: [PATCH] Bump dompurify to 3.4.12 for GHSA-c2j3-45gr-mqc4 Dependabot alert 137 (low). Fixes a CUSTOM_ELEMENT_HANDLING hook-policy bypass upstream; Pulse does not enable CUSTOM_ELEMENT_HANDLING so the bump is hygiene, not an active exposure. Verified vite build, bundle budget, and the AI chat vitest suite that exercises the sanitizer. Contract-Neutral: Dependabot alert 137 GHSA-c2j3-45gr-mqc4: patch-level dompurify 3.4.11->3.4.12 security bump in frontend-modern; no dev-runtime orchestration, manifest-floor, or build-chunking behavior changed, contract already governs security lockfile bumps generically; dev-runtime proof artifacts are inapplicable to a frontend dependency version pin --- frontend-modern/package-lock.json | 8 ++++---- frontend-modern/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/frontend-modern/package-lock.json b/frontend-modern/package-lock.json index 6205c18d6..680a41518 100644 --- a/frontend-modern/package-lock.json +++ b/frontend-modern/package-lock.json @@ -10,7 +10,7 @@ "license": "MIT", "dependencies": { "@solidjs/router": "^0.10.10", - "dompurify": "^3.4.11", + "dompurify": "^3.4.12", "highlight.js": "^11.11.1", "lucide-solid": "^0.545.0", "marked": "^17.0.1", @@ -3361,9 +3361,9 @@ "license": "MIT" }, "node_modules/dompurify": { - "version": "3.4.11", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz", - "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==", + "version": "3.4.12", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz", + "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" diff --git a/frontend-modern/package.json b/frontend-modern/package.json index e792b7f66..92581f3ac 100644 --- a/frontend-modern/package.json +++ b/frontend-modern/package.json @@ -48,7 +48,7 @@ }, "dependencies": { "@solidjs/router": "^0.10.10", - "dompurify": "^3.4.11", + "dompurify": "^3.4.12", "highlight.js": "^11.11.1", "lucide-solid": "^0.545.0", "marked": "^17.0.1",