Repository navigation
chore(deps): monaco-editor 0.57.0 and a dompurify override, clearing the last advisories - #175
Merged
Merged
Conversation
…the last advisories `npm audit` goes to zero: 0 critical, 0 high, 0 moderate, 0 low. The monaco bump alone does NOT fix it, which is worth recording because Dependabot says it does. 0.57.0 ships `"dompurify": "3.4.15"` as an EXACT pin, and the advisory range is `<= 3.4.16`, so npm has no room to resolve the fix. The `overrides` entry forcing `dompurify@3.4.17` is what actually closes GHSA-cg2g-xh64-v4q7 (critical) and GHSA-mrv2-3pqr-j5jr (high); 3.4.15 to 3.4.17 is a patch bump, so it is API-compatible with what monaco expects. config.ts says to re-measure rather than trust its numbers, so: one stylesheet, 275,966 bytes, on all 237 pages; Monaco 186,201 of them, 67.5%, about 27 KB of the file's 43 KB gzipped. Was 251,769 / 213 / 162,004 / 64.3% / 24 of 41 KB. The contiguity assumption the comment says to check before believing the percentage still holds — the boundary is still byte 89,765, with no `--vp-` after it and no `--vscode-` before. Monaco's JS is still async-only: 0 pages reference an `editor.api-` or `*.worker-` chunk. The prefetch paragraph's "0 prefetch links across 213 pages" is deliberately left alone. It records the state BEFORE the `shouldPrefetch` filter below it, and the built site now carries a prefetch link on all 237 pages, which is that filter working as designed, not drift. /playground/ was loaded from the built site and paints a styled editor. It logs `Failed to load worker script for label: editorWorkerService`, but that is PRE-EXISTING, not from this bump: a clean rebuild pinned to 0.56.0 produces the identical error in a fresh tab. The cause is that Playground.vue calls `await import('monaco-editor')` with no `MonacoEnvironment`/`getWorker` setup, so the language workers have never started. Filed separately.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm auditgoes to zero: 0 critical, 0 high, 0 moderate, 0 low. This clears the last two openalerts on the repo,
GHSA-cg2g-xh64-v4q7(critical) andGHSA-mrv2-3pqr-j5jr(high).The monaco bump alone does not fix it
Worth recording, because Dependabot reports
monaco-editor@0.57.0as the fix and it is not.0.57.0 ships
"dompurify": "3.4.15"as an exact pin, and the advisory range is<= 3.4.16, sonpm has no room to resolve the patch. Measured: with 0.57.0 and no override,
npm auditstillreported 1 critical.
The
overridesentry forcingdompurify@3.4.17is what actually closes them. 3.4.15 → 3.4.17 is apatch bump, so it is API-compatible with what monaco expects.
Re-measured, because config.ts says to
The contiguity assumption the comment says to verify before believing the percentage still holds:
boundary is still byte 89,765, with no
--vp-after it and no--vscode-before. Monaco's JS isstill async-only — 0 pages reference an
editor.api-or*.worker-chunk.The prefetch paragraph's "0 prefetch links across 213 pages" is deliberately left alone. It
records the state before the
shouldPrefetchfilter directly beneath it; the built site nowcarries a prefetch link on all 237 pages, which is that filter working, not drift.
A pre-existing problem this surfaced
config.ts says to confirm /playground/ still paints a styled editor. It does — loaded from the built
site, styled, syntax-highlighted, tabs working.
It also logs
Failed to load worker script for label: editorWorkerService. That is not from thisbump: a clean rebuild pinned to 0.56.0 produces the identical error in a fresh tab (verified with
distinct blob ids, so the messages are genuinely new rather than a stale console). The cause is that
Playground.vuecallsawait import('monaco-editor')with noMonacoEnvironment/getWorkersetup, so Monaco's language workers have never started. The editor renders and edits; validation
and IntelliSense do not run. Filed separately rather than fixed here.