From a2bd85d8067748f0c0ec58e0f6e35cd73b845432 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Fri, 17 Apr 2026 14:55:58 +0100 Subject: [PATCH] Bump dompurify 3.3.3 -> 3.4.0 to clear GHSA-39q2-94rc-95cp The advisory covers an ADD_TAGS form bypass of FORBID_TAGS. Pulse uses an ALLOWED_TAGS allowlist in frontend-modern/src/components/AI/aiChatUtils.ts and never combines ADD_TAGS with FORBID_TAGS, so we were not actually exposed, but staying on the patched line keeps the Dependabot surface clean. --- frontend-modern/package-lock.json | 8 ++++---- frontend-modern/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/frontend-modern/package-lock.json b/frontend-modern/package-lock.json index bfadb5a987..50aef19067 100644 --- a/frontend-modern/package-lock.json +++ b/frontend-modern/package-lock.json @@ -10,7 +10,7 @@ "license": "MIT", "dependencies": { "@solidjs/router": "^0.10.10", - "dompurify": "^3.3.3", + "dompurify": "^3.4.0", "lucide-solid": "^0.545.0", "marked": "^17.0.1", "qrcode": "^1.5.4", @@ -3316,9 +3316,9 @@ "license": "MIT" }, "node_modules/dompurify": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz", - "integrity": "sha512-Oj6pzI2+RqBfFG+qOaOLbFXLQ90ARpcGG6UePL82bJLtdsa6CYJD7nmiU8MW9nQNOtCHV3lZ/Bzq1X0QYbBZCA==", + "version": "3.4.0", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.0.tgz", + "integrity": "sha512-nolgK9JcaUXMSmW+j1yaSvaEaoXYHwWyGJlkoCTghc97KgGDDSnpoU/PlEnw63Ah+TGKFOyY+X5LnxaWbCSfXg==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" diff --git a/frontend-modern/package.json b/frontend-modern/package.json index 74c38105c4..4d5e9288b0 100644 --- a/frontend-modern/package.json +++ b/frontend-modern/package.json @@ -43,7 +43,7 @@ }, "dependencies": { "@solidjs/router": "^0.10.10", - "dompurify": "^3.3.3", + "dompurify": "^3.4.0", "lucide-solid": "^0.545.0", "marked": "^17.0.1", "qrcode": "^1.5.4",