fix(security): clear dompurify, js-yaml and nanoid advisories - #144
Merged
Conversation
- dompurify 3.4.12 -> 3.4.13 (GHSA-55q2-fjhq-7xh7) — runtime; ships to the browser via the Orama search UI - js-yaml 3.15.0 -> 3.15.1 and 4.3.0 -> 4.3.1 (direct dep raised to ^4.3.1) - nanoid 3.3.16 -> 3.3.18 — surfaced by npm audit, not yet a Dependabot alert image-size remains open and is not fixable: the advisory covers <= 2.0.2 and 2.0.2 is the latest published release. npm's only "fix" is a major DOWNGRADE of docusaurus-theme-openapi-docs to 1.0.6. It is build-time image-dimension probing over trusted repo content — tracked upstream, accepted for now. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
dompurify3.4.12 → 3.4.13 (GHSA-55q2-fjhq-7xh7) — runtime; ships to the browser via the Orama search UIjs-yaml3.15.0 → 3.15.1 and 4.3.0 → 4.3.1 (direct dep raised to^4.3.1)nanoid3.3.16 → 3.3.18 — surfaced bynpm audit, not yet a Dependabot alertjs-yamlneeds scoped overrides here rather than a plain one: the tree genuinely carries both majors, and js-yaml 4 droppedsafeLoad, so forcing a single major would break the 3.x consumer.Verification
npm audit --package-lock-only: down to theimage-sizechain only.Manual check after
npm run build && npm run start: search box returns results (the dompurify path).image-sizeis not fixableThe advisory covers
<= 2.0.2and 2.0.2 is the latest published release. npm's only "fix" is a major downgrade ofdocusaurus-theme-openapi-docsto 1.0.6. It is build-time image-dimension probing over trusted repo content. Tracked upstream; accepted for now rather than downgrading the theme.Pre-Review Checklist
package.json+package-lock.jsononly🤖 Generated with Claude Code