fix: update diff, dompurify, yaml, and solid-js for security patches

[jeanduplessis]

Summary

• Updates diff catalog from 8.0.2 to 8.0.4 and kilo-vscode from ^7.0.0 to 8.0.4 (major bump but API-compatible)
• Updates dompurify from 3.3.1 to 3.3.3 in catalog and packages/ui
• Updates yaml from 2.8.2 to 2.8.3 in kilo-vscode
• Updates solid-js catalog from 1.9.10 to 1.9.12 (fixes seroval transitively — 1.9.11+ uses seroval ~1.5.0 which is safe)

All are low-risk patch/minor bumps. The diff 7→8 major bump in kilo-vscode is the only notable change but the API is compatible.

Advisories Fixed

Advisory	Severity	Package	Description
GHSA-73rr-hh4g-fpgx	Low	diff	DoS in parsePatch/applyPatch
GHSA-h8r8-wccr-v5f2	Moderate	dompurify	Mutation-XSS via re-contextualization
GHSA-v2wj-7wpq-c8vv	Moderate	dompurify	XSS
GHSA-cjmm-f4jc-qw8r	Moderate	dompurify	ADD_ATTR URI validation bypass
GHSA-cj63-jhhr-wcxv	Moderate	dompurify	USE_PROFILES prototype pollution
GHSA-48c2-rrv3-qjmp	Moderate	yaml	Stack overflow via nested collections
GHSA-66fc-rw6m-c2q6	High	seroval (via solid-js)	DoS via Array serialization
GHSA-hx9m-jf43-8ffr	High	seroval (via solid-js)	DoS via RegExp serialization
GHSA-3rxj-6cgf-8cfw	High	seroval (via solid-js)	RCE via JSON deserialization
GHSA-hj76-42vx-jwp4	High	seroval (via solid-js)	Prototype pollution
GHSA-3j22-8qj3-26mx	High	seroval (via solid-js)	DoS via deeply nested objects

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

No new issues found in the incremental diff. The previously reported package.json dependency findings are resolved.

Fix these issues in Kilo Cloud

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
packages/kilo-vscode/src/agent-manager/GitOps.ts	206	Removing the background fetch from aheadBehind() makes sidebar and Agent Manager behind counts stale until the user manually refreshes remote refs.

Files Reviewed (2 files)

• bun.lock - 0 issues
• package.json - 0 issues

---

_{Reviewed by gpt-5.4-20260305 · 144,751 tokens}