mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 11:12:35 +02:00
maziggy
4f5bbde7de
npm audit flagged both against the production dependency tree, and the Frontend Security job fails on any fixable high-severity finding there (FIXABLE HIGH: linkify-it). linkify-it 5.0.1 -> 5.0.2 (GHSA-v245-v573-v5vm, high, CVSS 7.5) fixes a quadratic-complexity DoS in the mailto: validator scan loop. It reaches us only through prosemirror-markdown inside @tiptap/pm; the editor's own autolinking uses linkifyjs, which is a different package and unaffected. Nothing under frontend/src/ imports prosemirror-markdown or markdown-it and neither appears in the production bundle, so the vulnerable code is tree- shaken out and no running install was exposed. dompurify 3.4.11 -> 3.4.12 (GHSA-c2j3-45gr-mqc4, low) fixes a CUSTOM_ELEMENT_HANDLING bypass of afterSanitizeElements for allowed custom elements. DOMPurify is shipped, but we never set CUSTOM_ELEMENT_HANDLING and register no afterSanitizeElements hook, so the bypass has no precondition; ProjectPageModal additionally passes a strict ALLOWED_TAGS/ALLOWED_ATTR allowlist. Both patched versions already satisfy the ranges their parents declare, so this is a lockfile-only change - no overrides entry needed, package.json untouched. npm audit reports zero vulnerabilities, npm run build is clean, and all 2423 frontend tests pass.
