Update dompurify to 3.4.14 [SECURITY] - #2735
Merged
MarcusSorealheis merged 2 commits intoSep 5, 2026
Merged
Conversation
Fixes GHSA-55q2-fjhq-7xh7, GHSA-c2j3-45gr-mqc4, GHSA-cmwh-pvxp-8882, GHSA-gvmj-g25r-r7wr and GHSA-vxr8-fq34-vvx9 in the dompurify copy that mermaid pulls into the docs app. Lockfile-only change. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
amankrx
approved these changes
Sep 5, 2026
modernmedici
added a commit
to modernmedici/nativelink
that referenced
this pull request
Sep 6, 2026
* Introduce Rules Omniverse (TraceMachina#2720) * web: point Media kit Download at the shared Drive folder The company CTA was an incomplete folders/ URL and 404ed. Restore the folder id from the previous company page so Download opens the kit. Fixes TRA-548. Co-authored-by: Sumon Sadhu <sumon.sadhu@gmail.com> * Cursor/menlo security case study 6c68 (TraceMachina#2721) * docs: add Menlo Security Chromium case study Publish the approved external Menlo Security case study on Resources and style markdown tables in blog article prose so the results grid renders as a readable before/after comparison. * docs: use the Menlo Security wordmark on the case study Host the official site wordmark and point the post's Open Graph image at it, matching how CIQ and LastMile AI attach a customer logo. * docs: add Menlo hybrid Kubernetes topology figure Place the architecture slide under The Architecture so the hybrid control plane, local CAS, and elastic worker pools are visible next to the topology they describe. * docs: add Menlo Chromium build-time comparison figure Place the 4.5h to 25m lockup under The Results and use it as the Open Graph image so the social preview carries the same claim. * docs: enlarge the opening case-study pull quote Render blockquotes as a large first paragraph with a smaller attribution line so Christopher Staite's Chromium quote leads the Menlo article at pull-quote size rather than body type. * docs: make blog pull quotes a guaranteed larger size Style the opening quote with explicit CSS on the post page so the Staite line reads at 1.75–2rem instead of body type, with a smaller attribution under it. * docs: redesign blog prose for the Menlo case study Treat the article as long-form, not default markdown: a spec-sheet glance list, pull quote with mono attribution, metric table, captioned figures, and a closing card — using the Technical Warmth type and color system so the body actually reads. * docs: make blog list markers clearly brand purple Default discs were winning the eye on unordered lists. Force list-style off on items and use a 7px brand dot so Challenge bullets match the numbered rollout markers. * docs: point the Menlo case study CTA at enterprise.nativelink.com The closing get-started link went to app.nativelink.com; send readers to the enterprise site instead. * docs: add glance-row icons to the Menlo case study Put a small brand-tint icon on each At a Glance row so the spec sheet scans as Industry, Scale, Challenge, Solution, Result, and Adoption instead of a wall of labels. * docs: shrink glance icons so the spec sheet columns stay put Drop the tinted 26px tiles. Keep 11px brand marks in the existing row padding so Industry–Adoption still line up as before. * docs: add a Company header with the Menlo wordmark Lead the At a Glance spec sheet with a Company row so the table opens as COMPANY plus the Menlo Security logo. * docs: keep glance icons in-flow and add a Menlo company card Stop absolutely positioning row icons so they stay aligned with labels from desktop through phone. Replace the oversized wordmark with a compact company card: hexagonal mark, Menlo Security name, and menlosecurity.com. * docs: use the official Menlo wordmark in the company card Replace the cropped hexagonal O with Menlo Security's actual wordmark, kept small on a white logo tile. The card still spells out Menlo Security and links to menlosecurity.com. * docs: set the Menlo company cell in the glance table Drop the nested chip and white logo tile so Company reads as another spec-sheet row: official wordmark, Menlo Security, and the URL using the same type and colors as the rest of the table. * docs: add a Company icon and even out glance-table spacing Give Company the same in-flow label icon as the other spec-sheet rows, and tighten column gap, label gap, and the wordmark-to-name spacing so the first cell sits on the same rhythm as Industry through Adoption. * docs: scale the Menlo wordmark to the glance value stack * docs: tighten glance-table spacing and keep Company on the same grid Give Company a building icon like the other labels, top-align the wordmark lockup, and pull the label column in so icons sit with their copy instead of floating in a wide gutter. * docs: give stacked glance rows a little more breathing room * docs: center figure captions and number them Fig. 1 and Fig. 2 Label the build-time comparison and the hybrid topology with numbered captions, and center the sentences under each image. * docs: lock the Menlo wordmark to the name and URL Size the logo to the two-line type stack and space the name and URL against the top and bottom of the wordmark so MENLO lines up with Menlo Security and SECURITY lines up with the link. * chore: ignore JPEG assets in the marketing site Stop tracking the Menlo case-study photos and ignore *.jpg under web/apps/web so those binaries stay local. * chore: clear pre-commit failures on the Menlo case study Add a trailing newline to blog-prose CSS, stop tracking marketing binaries (JPEG and PNG), and fix Vale: keep Staite and Cybersecurity in the vocab, replace easily/configurability/Uncached in the copy. * docs: make the Menlo case study read more naturally Drop em dashes and rewrite the post in a more spoken register, without changing the facts. * chore: add trailing newline to the Menlo wordmark SVG The end-of-file-fixer hook requires files to end with a newline. --------- Co-authored-by: Marcus Eagan <marcuseagan@gmail.com> * Upgrade rules_rs to 0.0.108 to fix zlib issues (TraceMachina#2724) * Upgrade to Rust 1.97.1 (TraceMachina#2718) * Upgrade flake for newer Rust version * Use upstream cargo-llvm-cov * Remove unused async in evicting_map * Fix various sanitizer build issues * Fix complaint from unused_async_trait_impl * Lots of new linter issues * Improve asserts on is_empty As per https://rust-lang.github.io/rust-clippy/main/index.html#assert_is_empty * Clarify lib_tests failures * More version message changes and lint fixes * More async reductions * Even more clippy fixes * Cope with nightly-only lints * Upgrade scorecard action to 2.4.4 (TraceMachina#2725) * docs: track Menlo case-study figures under public/assets (TraceMachina#2723) Move the wordmark and figure paths off /case-studies, stop ignoring JPEGs on the marketing site, and allow these two figures through forbid-binary-files so they clone and render. * Retire queued actions no client is waiting on (TraceMachina#2726) * Sweep queued actions no client is waiting on * Only let a client's subscriber write the client keepalive * Expire the client keepalive key * Stop a refused update from leaving an empty record behind * Update Rust crate event-listener to 5.4.2 [SECURITY] (TraceMachina#2731) * Update Rust crate h2 to 0.4.19 [SECURITY] (TraceMachina#2732) * Update esbuild to 0.28.2 [SECURITY] (TraceMachina#2736) Fixes GHSA-g7r4-m6w7-qqqr (arbitrary file read from the esbuild dev server on Windows, 0.27.3 through 0.28.0) in the esbuild copy that fumadocs-mdx pulls into the docs app. Lockfile-only change. Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> * Update nanoid to 3.3.18 [SECURITY] (TraceMachina#2739) Fixes GHSA-28wg-ghj8-5hjv and GHSA-2v37-7h3g-55p8 (generators looping indefinitely on negative or zero sizes) in the nanoid copy that postcss pulls into both web apps. Lockfile-only change. Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> * Update dompurify to 3.4.14 [SECURITY] (TraceMachina#2735) * Update js-yaml to 4.3.2 [SECURITY] (TraceMachina#2737) * Update Next.js to 16.2.12 [SECURITY] (TraceMachina#2733) * Update mermaid to 11.17.2 [SECURITY] (TraceMachina#2738) Fixes GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6x64-9x62-f2gx, GHSA-c4c3-pg64-4m4v and GHSA-rhh3-jpg6-66xh in the docs app's mermaid dependency (range ^11.4.1 -> ^11.16.1). Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> * Update postcss to 8.5.28 [SECURITY] (TraceMachina#2740) Fixes GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93 and GHSA-r28c-9q8g-f849 in the postcss copy that @tailwindcss/postcss pulls into both web apps. Bumps nanoid to 3.3.18 as postcss now requires it. Lockfile-only change. Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Marcus Eagan <marcuseagan@gmail.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Tom Parker-Shemilt <tom@tracemachina.com> Co-authored-by: Aman Kumar <aman@tracemachina.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Bumps the transitive
dompurifypackage from 3.4.7 to 3.4.14 inweb/bun.lock. It is pulled in bymermaidin the docs app, and 3.4.7 isflagged by the OpenSSF Scorecard vulnerabilities check for five advisories,
all fixed by 3.4.13:
IN_PLACEhook removal leaves a detached subtree executable (XSS)
CUSTOM_ELEMENT_HANDLINGbypassesafterSanitizeElementsALLOWED_ATTRpollution viasetConfig()SAFE_FOR_TEMPLATESbypass inside<template>contentTypes policy survives
clearConfig()Only the lockfile changes;
mermaid's own range (^3.3.1) already allows3.4.14, so no manifest needs editing.
How was this verified?
the bump was done by adding a temporary
overridesentry fordompurify, runningbun install, removing the override, and runningbun installagain. The resulting diff is the singledompurifyentryin
bun.lock, andbun installreports no changes against theunmodified manifests.
bun run build --filter=@nativelink/docsbuilds the docs app, the onlyconsumer of
mermaid/dompurify, on this lockfile.Risk
Low. Patch releases of a sanitizer used client-side by mermaid diagrams in
the docs site. If mermaid rendering broke it would show on the docs preview
deploy; nothing outside
web/is touched.🤖 Generated with Claude Code
https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE