From 90c8cc1f6ea92c4048d75a29e766779fd6875a37 Mon Sep 17 00:00:00 2001
From: German Parente <gparente@redhat.com>
Date: Fri, 24 Jul 2026 16:06:06 +0200
Subject: [PATCH] Bug 2411052: Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7

Add dompurify resolution to bump transitive dependency from 3.2.7 to
^3.4.11, fixing DOMPurify IN_PLACE sanitization bypass via attached
Shadow Root inside <template>.content (XSS).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 frontend/package.json | 3 ++-
 frontend/yarn.lock    | 8 ++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/frontend/package.json b/frontend/package.json
index 0675a0be519..36802d60ba2 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -335,7 +335,8 @@
     "minimatch@^9.0.4": "^9.0.6",
     "fast-uri": "3.1.2",
     "shell-quote": "^1.8.4",
-    "protobufjs": "7.5.8"
+    "protobufjs": "7.5.8",
+    "dompurify": "^3.4.11"
   },
   "lint-staged": {
     "*.{js,jsx,ts,tsx,json,gql,graphql}": "eslint --color --fix"
diff --git a/frontend/yarn.lock b/frontend/yarn.lock
index 2bef54747fa..d1f54f1efa5 100644
--- a/frontend/yarn.lock
+++ b/frontend/yarn.lock
@@ -10025,15 +10025,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"dompurify@npm:^3.2.4":
-  version: 3.2.7
-  resolution: "dompurify@npm:3.2.7"
+"dompurify@npm:^3.4.11":
+  version: 3.4.12
+  resolution: "dompurify@npm:3.4.12"
   dependencies:
     "@types/trusted-types": "npm:^2.0.7"
   dependenciesMeta:
     "@types/trusted-types":
       optional: true
-  checksum: 10c0/d41bb31a72f1acdf9b84c56723c549924b05d92a39a15bd8c40bec9007ff80d5fccf844bc53ee12af5b69044f9a7ce24a1e71c267a4f49cf38711379ed8c1363
+  checksum: 10c0/127a13817353d4e20e75a991a9022a04c3af12af7479f68e2b8bee6dbc7330a96edfb8f4ebff96f4f0f24cd43e8dbba46214131f510c3aa87a843bd8b610d0ab
   languageName: node
   linkType: hard