Repository navigation
fix(deps): clear both open Dependabot alerts (postcss high, dompurify low) - #27
Merged
Merged
Conversation
postcss <= 8.5.17 (GHSA-r28c-9q8g-f849, high) is a path traversal in previous-source-map auto-loading that discloses arbitrary .map files. It arrives transitively twice — via vite, and via @milkdown/components -> vue -> @vue/compiler-sfc — so it needs an override rather than a direct bump. Forced to 8.5.18. dompurify <= 3.4.11 (GHSA-c2j3-45gr-mqc4, low) lets an allowed custom element bypass afterSanitizeElements via CUSTOM_ELEMENT_HANDLING. Rated low upstream, but DOMPurify is Toril's whole defense against hostile markup in an opened file (§3.3), so a sanitizer bypass is worth more here than the rating implies. Direct dep bumped to 3.4.12 and the existing override retargeted so the transitive tree follows. Both overrides carry their advisory ID and a drop-condition inline, matching the undici entry already in this file. Verified: no vulnerable versions remain in the lockfile; 133/133 tests, typecheck and build clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ides The web-editor conflict resolution left two problems, only one of which was visible. Visible: pnpm-lock.yaml had `dompurify@3.4.12` as a duplicated mapping key, so pnpm refused to read it at all (ERR_PNPM_BROKEN_LOCKFILE at 790:3) and both frontend jobs failed at the install step. Lockfiles are generated artifacts and can't be hand-merged — regenerated from main's copy instead of edited. Silent, and the one that mattered: the resolution kept main's overrides block, which reverted `dompurify@<3.4.11: 3.4.11` and dropped the postcss override entirely, while package.json still asked for 3.4.12. The high-severity postcss advisory (GHSA-r28c-9q8g-f849) would have been left unfixed by a PR whose whole purpose was fixing it, and the CI failure pointed at something unrelated. Both overrides restored; patchedDependencies from #25 kept. Verified: lockfile parses with no duplicate keys, `pnpm install --frozen-lockfile` is a no-op, dompurify@3.4.12 and postcss@8.5.18 resolve everywhere as single versions, 158/158 frontend, mdhtml/mdrtf/ fsatomic green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the two open Dependabot alerts. Both are transitive-reachable, both have upstream fixes, and neither required a code change.
<= 8.5.178.5.18<= 3.4.113.4.12, override retargetedpostcss — path traversal in source-map auto-loading
Previous-source-map auto-loading follows
sourceMappingURLwithout constraining the path, so a crafted stylesheet can disclose arbitrary.mapfiles. It reaches us transitively twice — viavite, and via@milkdown/components→vue→@vue/compiler-sfc— so a direct bump wouldn't cover it. Handled with apnpmoverride, matching howundiciis already pinned in this file.dompurify — sanitizer bypass
CUSTOM_ELEMENT_HANDLINGlets an allowed custom element bypass theafterSanitizeElementshook.Rated low upstream, and worth more attention than that here: CLAUDE.md §3.3 makes DOMPurify Toril's single chokepoint for hostile markup in an opened file, and §3 treats "treat opened files as untrusted" as non-negotiable. A bypass of the sanitizer's post-processing hook lands directly on that boundary. It's a direct dependency, so
package.jsonmoves to3.4.12and the existing override is retargeted so Milkdown's transitive copy follows.Verification
pnpm-lock.yaml—dompurify@3.4.12andpostcss@8.5.18resolve everywhere, single version each.pnpm test133/133 ·pnpm typecheckclean ·pnpm buildsucceeds.tests/security.test.ts) covers the sanitization chokepoint and passes on the new DOMPurify.Both overrides carry their advisory ID and a drop-condition inline, so they can be retired when the upstream ranges move rather than lingering unexplained.
Note on the other open PRs
This branches from
mainand is independent of #25 and #26. It touchespnpm-lock.yamlandpnpm-workspace.yaml, which #25 also touches — whichever merges second may need a lockfile regeneration (pnpm install) after taking both sets of YAML changes.🤖 Generated with Claude Code