From 3cc0665d455f5defdef77ed887aa8d72410b026d Mon Sep 17 00:00:00 2001 From: Joost de Valk Date: Sat, 8 Aug 2026 11:54:25 +0200 Subject: [PATCH] fix(deps): clear the three advisories failing the Security workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm audit --audit-level=high` has been failing on main and on every PR again, so every check run this week showed a red job while gating nothing. Same shape as #144. Three advisories, all resolved by `npm audit fix` within the existing semver ranges — no package.json change, no --force: dompurify 3.4.12 -> 3.4.13 (moderate) IN_PLACE hook removal leaves a detached subtree executable, causing XSS js-yaml 4.3.0 -> 4.3.1 (high) quadratic CPU in !!omap resolution nanoid 3.3.16 -> 3.3.18 (high) custom generators can loop indefinitely when size is zero dompurify is the one that matters beyond CI: it is a direct dependency that gets vendored to /vendor/purify.min.js and shipped to browsers, where it backs the Trusted Types default policy. `npm run assets` re-vendors it, so that file is in this commit too — a lockfile-only fix would have left 3.4.12 serving to visitors. The SRI hash is computed at build time from the file, so it tracks automatically; verified the built tag's sha384 matches the shipped bytes. Verified: lint, format:check, check:skill (168 pages), astro check (0 errors), test:websub, build (168 indexed). Loaded the built site and confirmed DOMPurify reports 3.4.13, the script passes SRI, the Trusted Types default policy registers and strips