[styayur]

The frontend Security job fails across the dependency PRs because Monaco 0.57.0 pins vulnerable DOMPurify 3.4.15. Its sanitizer is part of the production editor dependency tree.

Pin only monaco-editor>dompurify to 3.4.17 in pnpm's workspace overrides and regenerate the lockfile. This is the upstream patched version for GHSA-cg2g-xh64-v4q7 and GHSA-mrv2-3pqr-j5jr; the existing Monaco API and direct dependency ranges are retained. No advisory exception, audit severity threshold or workflow gate changes.

Local validation: frozen-lockfile install, frontend lint, TypeScript checking and production build. The complete audit JSON is retained locally; the existing pnpm audit --audit-level high and full Rust/desktop/MSRV matrix must pass on this PR before merge. Rust 1.90 compatibility validation is retained unchanged.

This fixes the shared security failure; the other independent dependency PRs still require rebasing and validation against the repaired default branch.

[styayur]

The shared frontend security failure is fixed at its production editor dependency: Monaco's pinned DOMPurify 3.4.15 is replaced by upstream-patched 3.4.17 for GHSA-cg2g-xh64-v4q7 and GHSA-mrv2-3pqr-j5jr.

Local frozen installation, lint, typecheck and production build pass. Fresh GitHub CI passes every check on this exact head: frontend audit, cargo audit, secret scan, Windows/Linux validation, CodeForge regression and Rust 1.90 MSRV. See https://github.com/styayur/codeforge-engine/pull/51/checks . The original high-severity threshold and all safety gates remain unchanged; no advisory exception was added.

The full local pnpm audit still reports one moderate minimatch advisory. It remains visible; passing the existing high-severity gate is not a claim of zero vulnerabilities. Other dependency PRs need validation on the repaired default branch before their own merges.