From c18d3696e9a4f8185ccb6527a4809b0fec9160e2 Mon Sep 17 00:00:00 2001 From: Anso Date: Mon, 27 Apr 2026 09:37:09 -0400 Subject: [PATCH] fix(deps): bump dompurify to 3.4.0 to resolve four advisories (#801) Resolves four DOMPurify advisories all patched in 3.4.0: - GHSA-39q2-94rc-95cp (ADD_TAGS function form bypasses FORBID_TAGS) - GHSA-v9jr-rg53-9pgp (CVE-2026-41238: prototype pollution to XSS via CUSTOM_ELEMENT_HANDLING fallback) - GHSA-h7mw-gpvr-xq4m (CVE-2026-41240: FORBID_TAGS bypass via function-based ADD_TAGS predicate) - GHSA-crv5-9vww-q3g8 (CVE-2026-41239: SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode) Bump is on the npm overrides entry (dompurify is a transitive dep), which forces the resolved version up the tree. Lockfile picks up 3.4.1 (latest 3.4.x). Frontend build clean, dev server boot clean, no runtime errors. --- frontend/package-lock.json | 6 +++--- frontend/package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 21f141d3..58eca538 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -4654,9 +4654,9 @@ "license": "MIT" }, "node_modules/dompurify": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz", - "integrity": "sha512-Oj6pzI2+RqBfFG+qOaOLbFXLQ90ARpcGG6UePL82bJLtdsa6CYJD7nmiU8MW9nQNOtCHV3lZ/Bzq1X0QYbBZCA==", + "version": "3.4.1", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.1.tgz", + "integrity": "sha512-JahakDAIg1gyOm7dlgWSDjV4n7Ip2PKR55NIT6jrMfIgLFgWo81vdr1/QGqWtFNRqXP9UV71oVePtjqS2ebnPw==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" diff --git a/frontend/package.json b/frontend/package.json index eefecaea..8b9b1e6c 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -57,7 +57,7 @@ "yaml": "^2.8.3" }, "overrides": { - "dompurify": "^3.3.3" + "dompurify": "^3.4.0" }, "devDependencies": { "@eslint/js": "^10.0.1",