From 4e38e0c2e4d3375e34b06663ad6d1f72e9975ade Mon Sep 17 00:00:00 2001 From: webreflection Date: Wed, 26 Aug 2026 14:18:08 +0200 Subject: [PATCH] fix(security): update DOMPurify to 3.4.13 to fix dependabot warnings --- .changeset/dompurify-security-update.md | 5 +++++ bun.lock | 10 +++++----- package.json | 4 ++-- packages/session-ui/package.json | 2 +- packages/ui/package.json | 2 +- 5 files changed, 14 insertions(+), 9 deletions(-) create mode 100644 .changeset/dompurify-security-update.md diff --git a/.changeset/dompurify-security-update.md b/.changeset/dompurify-security-update.md new file mode 100644 index 0000000000..a0a1a6ec6b --- /dev/null +++ b/.changeset/dompurify-security-update.md @@ -0,0 +1,5 @@ +--- +"kilo-code": patch +--- + +Update DOMPurify to 3.4.13 to fix XSS vulnerabilities flagged by Dependabot in markdown sanitization. diff --git a/bun.lock b/bun.lock index 7f314aa99b..9469d26a65 100644 --- a/bun.lock +++ b/bun.lock @@ -860,7 +860,7 @@ "@solidjs/meta": "catalog:", "@solidjs/router": "catalog:", "diff": "catalog:", - "dompurify": "3.3.1", + "dompurify": "3.4.13", "fuzzysort": "catalog:", "katex": "0.16.27", "luxon": "catalog:", @@ -955,7 +955,7 @@ "@solidjs/router": "catalog:", "@typescript/native-preview": "catalog:", "diff": "catalog:", - "dompurify": "3.4.2", + "dompurify": "3.4.13", "fuzzysort": "catalog:", "katex": "0.16.27", "luxon": "catalog:", @@ -1030,7 +1030,7 @@ "@xmldom/xmldom": ">=0.8.12", "defu": "6.1.6", "diff": "8.0.4", - "dompurify": "3.4.2", + "dompurify": "3.4.13", "effect": "catalog:", "fastify": ">=5.8.3", "happy-dom": ">=20.8.9", @@ -1078,7 +1078,7 @@ "ai": "6.0.235", "cross-spawn": "7.0.6", "diff": "8.0.4", - "dompurify": "3.4.2", + "dompurify": "3.4.13", "drizzle-kit": "1.0.0-rc.2", "drizzle-orm": "1.0.0-rc.2", "effect": "4.0.0-beta.83", @@ -3274,7 +3274,7 @@ "domhandler": ["domhandler@5.0.3", "", { "dependencies": { "domelementtype": "^2.3.0" } }, "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w=="], - "dompurify": ["dompurify@3.4.2", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-lHeS9SA/IKeIFFyYciHBr2n0v1VMPlSj843HdLOwjb2OxNwdq9Xykxqhk+FE42MzAdHvInbAolSE4mhahPpjXA=="], + "dompurify": ["dompurify@3.4.13", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ=="], "domutils": ["domutils@3.2.2", "", { "dependencies": { "dom-serializer": "^2.0.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3" } }, "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw=="], diff --git a/package.json b/package.json index a6c3fe6dca..a211379204 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,7 @@ "@solid-primitives/storage": "4.3.3", "@tailwindcss/vite": "4.1.11", "diff": "8.0.4", - "dompurify": "3.4.2", + "dompurify": "3.4.13", "drizzle-kit": "1.0.0-rc.2", "drizzle-orm": "1.0.0-rc.2", "effect": "4.0.0-beta.83", @@ -152,7 +152,7 @@ "fastify": ">=5.8.3", "vite": "7.3.5", "diff": "8.0.4", - "dompurify": "3.4.2", + "dompurify": "3.4.13", "happy-dom": ">=20.8.9", "@opentui/core": "catalog:", "@opentui/solid": "catalog:", diff --git a/packages/session-ui/package.json b/packages/session-ui/package.json index e8e9fa57df..dafbaa469d 100644 --- a/packages/session-ui/package.json +++ b/packages/session-ui/package.json @@ -53,7 +53,7 @@ "@solidjs/meta": "catalog:", "@solidjs/router": "catalog:", "diff": "catalog:", - "dompurify": "3.3.1", + "dompurify": "3.4.13", "fuzzysort": "catalog:", "katex": "0.16.27", "luxon": "catalog:", diff --git a/packages/ui/package.json b/packages/ui/package.json index 708305cbbb..832a9b1711 100644 --- a/packages/ui/package.json +++ b/packages/ui/package.json @@ -95,7 +95,7 @@ "@solidjs/meta": "catalog:", "@solidjs/router": "catalog:", "diff": "catalog:", - "dompurify": "3.4.2", + "dompurify": "3.4.13", "fuzzysort": "catalog:", "katex": "0.16.27", "marked": "catalog:",