Skip to content

fix(deps): upgrade dompurify (Aikido security advisories) - #627

Open
molon wants to merge 1 commit into
masterfrom
aikido/2026-08-10
Open

fix(deps): upgrade dompurify (Aikido security advisories)#627
molon wants to merge 1 commit into
masterfrom
aikido/2026-08-10

Conversation

@molon

@molon molon commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Upgrade dependencies with known vulnerabilities reported by Aikido Security:

  • dompurify: 3.4.12 → 3.4.13

Aikido findings resolved

Finding Severity Location
GHSA-55q2-fjhq-7xh7 51 ui/vuetifyx/vuetifyxjs/pnpm-lock.yaml
AIKIDO-2026-925458 31 ui/vuetifyx/vuetifyxjs/pnpm-lock.yaml

Covers 2 Aikido sub-issues across 2 finding groups. Some sub-issues are detections inside built container images; they clear once the image is rebuilt from this change.

Verification

Resolved versions were checked against the lockfile / module graph — not just the manifest edit, because a bumped manifest can still resolve to the old version when another constraint pins it:

  • dompurify3.4.13 (wanted 3.4.13, via lockfile (ui/vuetifyx/vuetifyxjs))

Build passes: pnpm install in ui/vuetifyx/vuetifyxjs, pnpm build in ui/vuetifyx/vuetifyxjs

Already failing on the base commit (verified by re-running the same command on 64587dfd4), unrelated to this change:

  • pnpm test:unit in ui/vuetifyx/vuetifyxjs

Notes

  • One PR per repository, as agreed; commits are split per logical change.
  • This PR is not merged automatically and touches no release-* branch.

Copilot AI lite review requested due to automatic review settings August 10, 2026 16:04

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR upgrades dompurify to address Aikido-reported security advisories in the ui/vuetifyx/vuetifyxjs frontend workspace.

Changes:

  • Bump dompurify dependency from ^3.4.12 to ^3.4.13 in package.json.
  • Update pnpm-lock.yaml to resolve and snapshot dompurify@3.4.13 (with 3.4.12 no longer present).

Reviewed changes

Copilot reviewed 1 out of 3 changed files in this pull request and generated no comments.

File Description
ui/vuetifyx/vuetifyxjs/package.json Updates the direct dompurify dependency constraint to ^3.4.13.
ui/vuetifyx/vuetifyxjs/pnpm-lock.yaml Updates lockfile entries to resolve dompurify@3.4.13 and removes 3.4.12 occurrences.
Files not reviewed (1)
  • ui/vuetifyx/vuetifyxjs/pnpm-lock.yaml: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants