Repository navigation
Fix npm audit advisories in the frontend (7.21.1) - #894
Merged
Merged
Conversation
dompurify 3.4.16 -> 3.4.17 fixes GHSA-cg2g-xh64-v4q7 (SAFE_FOR_TEMPLATES bypass in shadow root content), GHSA-mrv2-3pqr-j5jr (IN_PLACE hook leaving a detached subtree's handlers armed, an incomplete fix for GHSA-p98j-92pf-mc4p) and GHSA-c6gr-qvv4-5v3f (SMIL attributeName=href guard skipped for application/xhtml+xml), all critical. It ships in the built assets, so the package.json floor rises to ^3.4.17. The dev-only vite 8.2.2 -> 8.3.5 (with rolldown, postcss and nanoid) clears six high advisories in the dev server and launch-editor. npm audit reports none. Co-Authored-By: Claude Opus 5.5 <[email protected]>
dompurify 3.4.17 fixes three critical advisories in the shipped frontend, and the dev-only vite update clears six high ones. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patch release for the frontend advisories
npm auditreported.dompurify3.4.16 → 3.4.17 fixes three critical advisories. DOMPurify is a runtime dependency that ships in the served assets, so thepackage.jsonfloor rises from^3.4.16to^3.4.17.SAFE_FOR_TEMPLATESbypass in attached shadow root content.IN_PLACE, a node-removing hook left a detached subtree's handlers armed. This completes the GHSA-p98j-92pf-mc4p fix from 7.6.1.attributeName=hrefguard was skipped forapplication/xhtml+xml.vite8.2.2 → 8.3.5 clears six high advisories in the dev server andlaunch-editor.rolldown,postcssandnanoidmove with it. These are dev-only and don't reach the served assets or installs.CHANGELOG.mdhas a 7.21.1 Security entry, andpyproject.tomlgoes to 7.21.1.Testing
npm auditon the frontend reports 0 vulnerabilities.vite buildsucceeds.🤖 Generated with Claude Code