Repository navigation
fix: update dompurify to resolve GHSA-cg2g-xh64-v4q7 - #959
independabot-soc2[bot] wants to merge 1 commit into
Conversation
Co-Authored-By: Oz <oz-agent@warp.dev>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This PR was generated with Warp. Comment |
|
@independabot-soc2[bot] I'm starting a first review of this pull request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
![warp-for-oss[bot]](https://avatars.githubusercontent.com/in/3450139?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview
This PR pins Mermaid's transitive DOMPurify dependency to 3.4.17 through an npm override and updates the lockfile to the patched package version. The attached spec context says no approved or repository spec applies, and the diff introduces no comments or tests to audit.
Concerns
- No blocking concerns found in the annotated diff.
Verdict
Found: 0 critical, 0 important, 0 suggestions
Approve
Comment /warp-agent-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.
Please merge this PR yourself, if you approve.
Summary
Pin mermaid's transitive DOMPurify from 3.4.16 to 3.4.17 with an npm override.
Related issues
Validation
npm ci,npm ls dompurify→ 3.4.17 overriddennpm audit: no DOMPurify finding; remaining 7 findings are unrelated (astro, braces/micromatch, vite)npm run typecheck(0 errors),test:heading-vars(5/5),build,test:heading-tocs(3391 entries / 401 pages),test:homepage-json-ldpassed^22.18.0 || >=24.11.0. Trunk not installed.Screenshots
None. Dependency-only change.
Follow-ups
Vite is already covered by #940. braces CVE-2026-93687 has no patched release. astro 7.3.2 remains (CVE-2026-114127).
BEFORE YOU MERGE
Instructions for resolving the vuln
dompurify3.4.16 → 3.4.17 (mermaid-scoped npm override)Highlight the risky code / where the dependency was used
Mermaid diagrams in the docs site (
mermaid→dompurify). Compatibility impact is the sanitizer patch in 3.4.17.Special instructions for this PR
Confirm mermaid diagrams still render after merge. No post-merge steps.
AFTER YOU MERGE
None.