julien/apf_portal
1
0
Fork 0
Code Issues 1 Pull Requests Actions 1 Packages Projects Releases Wiki Activity

chore(deps): bump dompurify override to >=3.4.5 (GHSA-87xg-pxx2-7hvx) #267

Merged
julien merged 1 commits from chore/bump-dompurify-override-ghsa-87xg-pxx2-7hvx into main 2026-06-02 12:22:04 +02:00
Conversation 0 Commits 1 Files Changed 2
+6 -5

1 Commits

Author SHA1 Message Date
Julien Gautier a62093155e chore(deps): bump dompurify override to >=3.4.5 (GHSA-87xg-pxx2-7hvx)
CI / commits (pull_request) Successful in 2m43s
Details
CI / scan (pull_request) Successful in 3m4s
Details
CI / check (pull_request) Successful in 5m6s
Details
CI / a11y (pull_request) Successful in 2m8s
Details
Docs site / build (pull_request) Successful in 2m24s
Details
CI / perf (pull_request) Successful in 5m11s
Details 
dompurify@3.4.4 is vulnerable to XSS via the selectedcontent re-clone
path (GHSA-87xg-pxx2-7hvx). dompurify is transitive via mermaid; the
latest mermaid (11.15.0) declares dompurify@^3.3.1 — that range still
permits 3.4.4 so an upstream bump does not move us off the vulnerable
version. Add an override matching the existing pattern for axios /
tmp / esbuild / etc.

Resolved version after install: dompurify@3.4.7. Patch-range bump
on a sanitisation-only library — risk minimal.
 2026-06-02 12:13:07 +02:00