From f5559407c9379a9241b82401e12df65fa933c700 Mon Sep 17 00:00:00 2001 From: sec-check Date: Wed, 30 Sep 2026 21:38:38 -0400 Subject: [PATCH] fix: bump dompurify and brace-expansion in lockfile to latest patch releases Raise the `overrides` floors in package.json so the lockfile resolves dompurify 3.4.16 (via mermaid) and brace-expansion 2.1.7 (via minimatch 3), and regenerate package-lock.json. No code changes; `npm ci` and the Mermaid tests pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: sec-check --- .../fixed-bump-dompurify-brace-expansion.md | 1 + package-lock.json | 22 +++++-------------- package.json | 4 ++-- 3 files changed, 9 insertions(+), 18 deletions(-) create mode 100644 changelog.d/fixed-bump-dompurify-brace-expansion.md diff --git a/changelog.d/fixed-bump-dompurify-brace-expansion.md b/changelog.d/fixed-bump-dompurify-brace-expansion.md new file mode 100644 index 0000000..0a1fc14 --- /dev/null +++ b/changelog.d/fixed-bump-dompurify-brace-expansion.md @@ -0,0 +1 @@ +- Bump `dompurify` to 3.4.16 and `brace-expansion` to 2.1.7 in the lockfile via `overrides`, picking up the latest patch releases for both. diff --git a/package-lock.json b/package-lock.json index 7c3923e..f5927f0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5962,19 +5962,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, - "node_modules/brace-expansion/1.1.7": { - "version": "1.1.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.7.tgz", - "integrity": "sha512-ZwQtfk+40zFGKKwYPQHqw7GbzMyaKXqCXXMoKR6gKPQVN3ZXhSW8nIbWkD2wBZYFVn8T7FHZZImlZGxn2FQkGg==", - "extraneous": true, + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -7112,9 +7102,9 @@ "license": "MIT" }, "node_modules/dompurify": { - "version": "3.4.13", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz", - "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==", + "version": "3.4.16", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz", + "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" diff --git a/package.json b/package.json index 76b7ee2..cc229fe 100644 --- a/package.json +++ b/package.json @@ -73,8 +73,8 @@ "overrides": { "@xmldom/xmldom": ">=0.9.10", "axios": ">=1.16.0", - "brace-expansion": "^2.0.1", - "dompurify": ">=3.4.13", + "brace-expansion": "^2.1.7", + "dompurify": ">=3.4.16", "linkify-it": ">=5.0.2", "lodash-es": ">=4.18.0", "follow-redirects": ">=1.16.0",