From cf4ae026f7255e84d04851f1c771ed5ebe2862cf Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 18:07:15 +0000 Subject: [PATCH] =?UTF-8?q?fix(deps):=20dompurify=20=E9=A1=B6=E5=88=B0=203?= =?UTF-8?q?.4.13,=E6=B8=85=E6=8E=89=20GHSA-55q2-fjhq-7xh7=20(#6407)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `Validate Package Dependencies` 的 OSV-Scanner 在 pnpm-lock.yaml 上命中 GHSA-55q2-fjhq-7xh7(5.1 medium):dompurify 的 IN_PLACE hook 移除会留下 一棵仍可执行的 detached subtree(XSS)。公告有 fixed version(3.4.13), 按 osv-scanner.toml 抬头写明的纪律,这类一律「take the fix」,不走豁免。 dompurify 是 mermaid 的传递依赖(apps/docs 声明 mermaid ^11.16.0, mermaid@11.16.1 声明 dompurify ^3.3.3),没有任何工作区包直接声明它, 所以落点是 pnpm-workspace.yaml 的 override 块 —— 本仓不读 package.json 里的 overrides。 选择器上界放在 4.0.0 这个 major 边界而不是 exclusive 的 fixed version: 写成 `<3.4.13` 会在 3.4.13 自己被公告的那天静默失配(undici 7.28.0 与 brace-expansion 5.0.8 两具活体标本,#4961 / #5032)。以后只挪 target。 Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01BDmDsu2575gDxeMCxXhDE3 --- pnpm-lock.yaml | 9 +++++---- pnpm-workspace.yaml | 18 ++++++++++++++++++ 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 520eadf03b..cac5c54c86 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -33,6 +33,7 @@ overrides: '@hono/node-server@<3.0.0': ^2.0.10 fast-uri@<4.0.0: ^3.1.5 hono@<5.0.0: ^4.12.34 + dompurify@<4.0.0: ^3.4.13 importers: @@ -5777,8 +5778,8 @@ packages: dom-accessibility-api@0.5.16: resolution: {integrity: sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==} - dompurify@3.4.12: - resolution: {integrity: sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==} + dompurify@3.4.13: + resolution: {integrity: sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==} dotenv-flow@4.1.0: resolution: {integrity: sha512-0cwP9jpQBQfyHwvE0cRhraZMkdV45TQedA8AAUZMsFzvmLcQyc1HPv+oX0OOYwLFjIlvgVepQ+WuQHbqDaHJZg==} @@ -12090,7 +12091,7 @@ snapshots: dom-accessibility-api@0.5.16: {} - dompurify@3.4.12: + dompurify@3.4.13: optionalDependencies: '@types/trusted-types': 2.0.7 @@ -13650,7 +13651,7 @@ snapshots: d3-sankey: 0.12.3 dagre-d3-es: 7.0.14 dayjs: 1.11.21 - dompurify: 3.4.12 + dompurify: 3.4.13 es-toolkit: 1.49.0 katex: 0.16.47 khroma: 2.1.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index f20dee1b17..b0edbec496 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -192,3 +192,21 @@ overrides: # compatibility. check-override-consistency.mjs covers both forms. 'fast-uri@<4.0.0': '^3.1.5' 'hono@<5.0.0': '^4.12.34' + # OSV 2026-08-07 (#6407) — transitive-only, and the same "it has a fix, so + # take the fix" disposition as the batch above: + # dompurify GHSA-55q2-fjhq-7xh7 (5.1 medium) — an IN_PLACE hook removal + # leaves a detached subtree executable (XSS). Advisory range is + # introduced:0 → fixed:3.4.13, i.e. every version up to and including + # 3.4.12 is affected, so the selector's floor is the package floor and + # only the upper bound needs stating. Transitive-only via mermaid + # (apps/docs declares mermaid ^11.16.0; mermaid@11.16.1 declares + # dompurify ^3.3.3). Nothing in this workspace declares dompurify + # directly, so there is no publishable manifest to keep in lockstep — + # check-override-consistency.mjs will list this as an override it cannot + # cross-check against a declared range, which is correct for this shape. + # ^3.4.13 sits INSIDE mermaid's own ^3.3.3 range, so this is a dedupe onto + # the patched line rather than a forced upgrade past what mermaid supports. + # Bound at the 4.0.0 major boundary per this block's header rule — never + # `<3.4.13`, which would self-invalidate the day 3.4.13 is itself flagged + # (the undici 7.28.0 / brace-expansion 5.0.8 specimens, #4961 / #5032). + 'dompurify@<4.0.0': '^3.4.13'