From 51d39f90f08ff631b564d3fe53d3f95dfdd43507 Mon Sep 17 00:00:00 2001
From: Ryan Pope <ryan@ryanpope.com>
Date: Sun, 1 Nov 2026 17:58:34 -0600
Subject: [PATCH] build(web): move to TypeScript 6.0 and patch Monaco's
 DOMPurify

TypeScript 6.0.3 is the newest release typescript-eslint supports. An npm
override lets openapi-typescript (which declares ^5) use it; the
regenerated API types are identical.

Monaco 0.57 pins DOMPurify 3.4.15, which has several XSS advisories; an
override points it at our own 3.4.17.
---
 CHANGELOG.md          |  4 +++-
 web/package-lock.json | 17 ++++-------------
 web/package.json      | 10 +++++++++-
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fac0a21..204bb4e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,7 +16,7 @@ All notable changes are documented here. The format follows [Keep a Changelog](h
 
 ### Changed
 
-- Dependencies brought up to date: Clang 23 from LLVM's apt repository (was Debian's Clang 19), Node 26 LTS for the web build and CI (was 22), Gson 2.15, TanStack Query 5.105.1. The excluded test cases were regenerated with the new toolchain. TypeScript stays on 5.9 until openapi-typescript and typescript-eslint support 7.
+- Dependencies brought up to date: Clang 23 from LLVM's apt repository (was Debian's Clang 19), Node 26 LTS for the web build and CI (was 22), Gson 2.15, TanStack Query 5.105.1. The excluded test cases were regenerated with the new toolchain. TypeScript 6.0 (7 waits on typescript-eslint support).
 
 ### Fixed
 
@@ -24,6 +24,8 @@ All notable changes are documented here. The format follows [Keep a Changelog](h
 
 ### Security
 
+- Monaco's bundled DOMPurify is pinned to our patched 3.4.17 (Monaco 0.57 pins 3.4.15, affected by several XSS advisories); `npm audit --omit=dev` reports no vulnerabilities.
+
 - The runner has no network; the app reaches it over a group-restricted Unix socket.
 - Both containers run without root privileges or unneeded capabilities, under `no-new-privileges`.
 - Host-header and Origin checks, a content security policy and other security headers.
diff --git a/web/package-lock.json b/web/package-lock.json
index bc7878b..07c8c08 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -33,7 +33,7 @@
         "openapi-typescript": "^7.13.0",
         "playwright": "^1.64.1",
         "prettier": "^3.9.10",
-        "typescript": "5.9.3",
+        "typescript": "6.0.3",
         "typescript-eslint": "^8.72.1",
         "vite": "8.3.5",
         "vitest": "^5.0.5"
@@ -2631,15 +2631,6 @@
         "marked": "14.0.0"
       }
     },
-    "node_modules/monaco-editor/node_modules/dompurify": {
-      "version": "3.4.15",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz",
-      "integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
-      "optionalDependencies": {
-        "@types/trusted-types": "^2.0.7"
-      }
-    },
     "node_modules/monaco-editor/node_modules/marked": {
       "version": "14.0.0",
       "resolved": "https://registry.npmjs.org/marked/-/marked-14.0.0.tgz",
@@ -3223,9 +3214,9 @@
       }
     },
     "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
diff --git a/web/package.json b/web/package.json
index af9e7ff..2532eb7 100644
--- a/web/package.json
+++ b/web/package.json
@@ -41,9 +41,17 @@
     "openapi-typescript": "^7.13.0",
     "playwright": "^1.64.1",
     "prettier": "^3.9.10",
-    "typescript": "5.9.3",
+    "typescript": "6.0.3",
     "typescript-eslint": "^8.72.1",
     "vite": "8.3.5",
     "vitest": "^5.0.5"
+  },
+  "overrides": {
+    "openapi-typescript": {
+      "typescript": "$typescript"
+    },
+    "monaco-editor": {
+      "dompurify": "$dompurify"
+    }
   }
 }