Skip to content

Add DOMPurify cross-realm fixed references#8602

Draft
cookesan wants to merge 2 commits into
github:cookesan/advisory-improvement-8602from
cookesan:dompurify-hpcv-fixed-references
Draft

Add DOMPurify cross-realm fixed references#8602
cookesan wants to merge 2 commits into
github:cookesan/advisory-improvement-8602from
cookesan:dompurify-hpcv-fixed-references

Conversation

@cookesan

@cookesan cookesan commented Jul 7, 2026

Copy link
Copy Markdown

Adds DOMPurify 3.4.6 fixed release, source, and package references for GHSA-hpcv-96wg-7vj8.

Audit refresh, July 8, 2026:

  • Confirmed GHSA-hpcv-96wg-7vj8 maps to CVE-2026-49458.
  • Confirmed the upstream security advisory, repository, 3.4.6 release tag, 3.4.6 source tree, and npm 3.4.6 package reference resolve.
  • Local checks passed: one advisory JSON file changed in the PR diff, JSON parses, git diff --check passes, and the worktree is clean.

@github-actions github-actions Bot changed the base branch from main to cookesan/advisory-improvement-8602 July 7, 2026 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant