vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-19 02:28:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

Bump dompurify 3.3.3 -> 3.4.0 to clear GHSA-39q2-94rc-95cp

Browse source 
The advisory covers an ADD_TAGS form bypass of FORBID_TAGS. Pulse uses
an ALLOWED_TAGS allowlist in frontend-modern/src/components/AI/aiChatUtils.ts
and never combines ADD_TAGS with FORBID_TAGS, so we were not actually
exposed, but staying on the patched line keeps the Dependabot surface
clean.
This commit is contained in:
rcourtman 2026-04-17 14:55:58 +01:00
parent 85191a9051
commit a2bd85d806
2 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
frontend-modern/package-lock.json generated
View file

@ -10,7 +10,7 @@
"license": "MIT",
"dependencies": {
"@solidjs/router": "^0.10.10",
"dompurify": "^3.3.3",
"dompurify": "^3.4.0",
"lucide-solid": "^0.545.0",
"marked": "^17.0.1",
"qrcode": "^1.5.4",
@ -3316,9 +3316,9 @@
"license": "MIT"
},
"node_modules/dompurify": {
"version": "3.3.3",
"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz",
"integrity": "sha512-Oj6pzI2+RqBfFG+qOaOLbFXLQ90ARpcGG6UePL82bJLtdsa6CYJD7nmiU8MW9nQNOtCHV3lZ/Bzq1X0QYbBZCA==",
"version": "3.4.0",
"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.0.tgz",
"integrity": "sha512-nolgK9JcaUXMSmW+j1yaSvaEaoXYHwWyGJlkoCTghc97KgGDDSnpoU/PlEnw63Ah+TGKFOyY+X5LnxaWbCSfXg==",
"license": "(MPL-2.0 OR Apache-2.0)",
"optionalDependencies": {
"@types/trusted-types": "^2.0.7"

2
frontend-modern/package.json
View file

@ -43,7 +43,7 @@
},
"dependencies": {
"@solidjs/router": "^0.10.10",
"dompurify": "^3.3.3",
"dompurify": "^3.4.0",
"lucide-solid": "^0.545.0",
"marked": "^17.0.1",
"qrcode": "^1.5.4",