From 0e9aac5f1ee2295ed84ea194e890da6bdc556e63 Mon Sep 17 00:00:00 2001 From: Patrick Bertsch Date: Mon, 26 Oct 2026 20:15:31 -0600 Subject: [PATCH] chore(deps): bump dompurify monaco-editor 0.57.0 declares dompurify exactly at 3.4.15, so npm update cannot move the resolved version. An npm override sets dompurify to 3.4.17 for the Studio frontend's whole tree, the patched release for GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f, GHSA-6688-9rhm-gjv2 and GHSA-p98j-92pf-mc4p. The editor does not import this npm package. It bundles its own copy of DOMPurify, 3.4.15, and the built assets still contain that copy, so the override changes the lockfile and node_modules, not the code that ships. The advisories need options the bundled sanitizer does not set: IN_PLACE, SAFE_FOR_TEMPLATES or PARSER_MEDIA_TYPE. Shipping the patched sanitizer needs a monaco-editor release that bundles 3.4.17. Checked with npm ci, npm run build, typecheck:device-view, test:device-view, test:probescript and check:probescript. --- CHANGELOG.md | 1 + studio/frontend/package-lock.json | 6 +++--- studio/frontend/package.json | 3 +++ 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 15bc84c7..8c715806 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -61,6 +61,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). - **VS Code: the Run Test commands no longer pass `--name` to `probe test`.** This version of the CLI defines no such flag, so those runs failed with an unknown-flag error. "FlutterProbe: Run Test File at Cursor", the CodeLens buttons and the Tests view now run the file that contains the test, and their titles and tooltips say so. Until the CLI has a per-test filter, the extension runs whole files. - **Studio: the top bar is a window drag handle on macOS.** It used `-webkit-app-region`, which Wails does not read, so the full-size content view had no drag handle. It now sets `--wails-draggable: drag`; its buttons and device picker opt out so their clicks still work. - **Studio: the macOS window has its native title bar again.** The title bar was transparent, and Wails then makes the web view cover it, so the window had no native drag area and some toolbar controls did not show. The title bar is now opaque and sits above the top bar, so the window can be dragged from it and every control shows. +- **Dev tooling: the Studio frontend's npm tree resolves `dompurify` 3.4.17.** `monaco-editor` pins `dompurify` exactly to 3.4.15, so an override sets the npm package to 3.4.17. The editor bundles its own copy of DOMPurify, which is unchanged at 3.4.15, so the code Studio ships does not change. The advisories need options that the bundled sanitizer does not set. ## [0.26.0] - 2026-10-14 diff --git a/studio/frontend/package-lock.json b/studio/frontend/package-lock.json index 09ca7ad1..52afd87a 100644 --- a/studio/frontend/package-lock.json +++ b/studio/frontend/package-lock.json @@ -674,9 +674,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.15", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz", - "integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==", + "version": "3.4.17", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz", + "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" diff --git a/studio/frontend/package.json b/studio/frontend/package.json index 316e3ce8..5ce1de22 100644 --- a/studio/frontend/package.json +++ b/studio/frontend/package.json @@ -22,5 +22,8 @@ "@types/node": "^26.6.5", "typescript": "^7.0.2", "vite": "^8.3.5" + }, + "overrides": { + "dompurify": "3.4.17" } }