From 6303d653aa25d849def324fe2e7adc8c65d46f22 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Fri, 9 Oct 2026 00:26:52 -0700 Subject: [PATCH] web: bump DOMPurify to 3.4.16 (GHSA-p98j-92pf-mc4p) DOMPurify 3.4.13-3.4.15 can leave event handlers armed on a detached subtree when IN_PLACE sanitizing is combined with a node-removing afterSanitize hook (GHSA-p98j-92pf-mc4p, low). The message sanitizer uses neither (only an afterSanitizeAttributes hook), so it isn't believed affected, but the fix is a patch release. Typecheck, tests and build pass. --- package-lock.json | 8 ++++---- web/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index b8bacac..63756fe 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1649,9 +1649,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.15", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz", - "integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==", + "version": "3.4.16", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz", + "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -3071,7 +3071,7 @@ "license": "AGPL-3.0-or-later", "dependencies": { "@tanstack/react-virtual": "^3.14.12", - "dompurify": "^3.4.15", + "dompurify": "^3.4.16", "lucide-react": "^1.45.0", "marked": "^18.0.11", "qrcode-generator": "^2.0.4", diff --git a/web/package.json b/web/package.json index 7e6ba60..b16e2a6 100644 --- a/web/package.json +++ b/web/package.json @@ -13,7 +13,7 @@ }, "dependencies": { "@tanstack/react-virtual": "^3.14.12", - "dompurify": "^3.4.15", + "dompurify": "^3.4.16", "lucide-react": "^1.45.0", "marked": "^18.0.11", "qrcode-generator": "^2.0.4", -- 2.54.0