coffey-labs/ihasmail
1
2 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity Sponsor

Update DOMPurify, hono, vite and vitest for security fixes #61

Merged
jcoffey-dev merged 1 commits from fix/dependabot-2026-10-22 into main 2026-10-22 22:51:44 +00:00
Conversation 0 Commits 1 Files Changed 3
+145 -163
jcoffey-dev commented 2026-10-22 22:47:38 +00:00
Owner
Copy link
Copy source

Patch-level updates for published advisories. npm audit reports 0 afterwards.

  • dompurify 3.4.16 → 3.4.17: GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f. We sanitize mail and markdown with RETURN_DOM and an afterSanitizeAttributes hook. We don't use SAFE_FOR_TEMPLATES, IN_PLACE or PARSER_MEDIA_TYPE, so none of the three matches our setup exactly, but this is the sanitizer.
  • hono 4.13.7 → 4.13.13: GHSA-5r4p-p66f-jhc7 is in hono's serveStatic, which we don't use (our own server/src/static.ts decodes once).
  • vite 8.3.0 → 8.3.5, source-map-js 1.2.1 → 1.2.2, vitest 5.0.0 → 5.0.5: dev server and build tooling only.

Locally: npm ci, typecheck, tests and build all pass. No new strings.

Patch-level updates for published advisories. `npm audit` reports 0 afterwards. - **dompurify 3.4.16 → 3.4.17**: GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f. We sanitize mail and markdown with `RETURN_DOM` and an `afterSanitizeAttributes` hook. We don't use `SAFE_FOR_TEMPLATES`, `IN_PLACE` or `PARSER_MEDIA_TYPE`, so none of the three matches our setup exactly, but this is the sanitizer. - **hono 4.13.7 → 4.13.13**: GHSA-5r4p-p66f-jhc7 is in hono's `serveStatic`, which we don't use (our own `server/src/static.ts` decodes once). - **vite 8.3.0 → 8.3.5**, **source-map-js 1.2.1 → 1.2.2**, **vitest 5.0.0 → 5.0.5**: dev server and build tooling only. Locally: npm ci, typecheck, tests and build all pass. No new strings.
jcoffey-dev added 1 commit 2026-10-22 22:47:38 +00:00
Update DOMPurify, hono, vite and vitest for security fixes
ci / node (pull_request) Skipped
Details
ci / version (pull_request) Skipped
Details
ci / docker-build (pull_request) Skipped
Details
ci / publish (pull_request) Skipped
Details
github/ci (branch) GitHub Actions
Details
ci / github (pull_request) Successful in 3m14s
Details
a03abab337 
DOMPurify 3.4.17, hono 4.13.13, vite 8.3.5 (source-map-js 1.2.2) and vitest 5.0.5. npm audit is clean afterwards.
jcoffey-dev merged commit 51b3648f63 into main 2026-10-22 22:51:44 +00:00
jcoffey-dev deleted branch fix/dependabot-2026-10-22 2026-10-22 22:51:44 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something isn't working
 dependencies
Dependency updates
 documentation
Docs, README or site copy
 duplicate
Already tracked elsewhere
 enhancement
New feature or improvement
 good first issue
Good for newcomers
 help wanted
Contributions welcome
 invalid
Not a valid issue
 needs info
Waiting on the reporter for details
 question
Needs an answer, not a code change
 security
Security issue or hardening
 translation
New language or translation fixes
 wontfix
Will not be worked on
priority
p1
High priority
priority
p2
Medium priority
priority
p3
Low priority
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcoffey-dev (John Coffey)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coffey-labs/ihasmail#61