chore(deps): pin dompurify and protobufjs to patch Vanta CVEs#1090
Merged
Conversation
Add pnpm overrides forcing transitive dompurify (>=3.4.7 <4, via mermaid/ posthog-js/swagger-ui-react) and protobufjs (>=7.6.3 <8, via @opentelemetry/otlp-transformer) past their flagged advisories. Resolves CVE-2026-49459, CVE-2026-49458, GHSA-76mc-f452-cxcm (dompurify) and CVE-2026-54269 (protobufjs). Ranges capped below the next major to stay within consumers' declared semver.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
juan-arcadedev
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remediates the four Vanta/Dependabot advisories (all MEDIUM) by adding pnpm overrides in
pnpm-workspace.yamlthat force the transitive dompurify (>=3.4.7 <4, pulled by mermaid/posthog-js/swagger-ui-react) and protobufjs (>=7.6.3 <8, pulled by @opentelemetry/otlp-transformer) past the vulnerable versions, resolving to dompurify@3.4.12 and protobufjs@7.6.5. This clears CVE-2026-49459, CVE-2026-49458, and GHSA-76mc-f452-cxcm (dompurify) plus CVE-2026-54269 (protobufjs). Both ranges are capped below the next major so the bump stays within each consumer's declared semver and doesn't pull a breaking major.pnpm-lock.yamlwas regenerated and the full test suite passes (767/767).Note
Low Risk
Lockfile-only dependency pinning with semver caps below the next major; no runtime code changes.
Overview
Adds pnpm workspace overrides for transitive dompurify (
>=3.4.7 <4) and protobufjs (>=7.6.3 <8), following the same pattern as existing security pins inpnpm-workspace.yaml. The lockfile is updated so installs resolve to dompurify@3.4.12 (replacing 3.4.1) and protobufjs@7.6.5 (replacing 7.6.2), including consumers such as mermaid, posthog-js, swagger-ui-react, and@opentelemetry/otlp-transformer.The protobufjs bump also drops
@protobufjs/inquirefrom the resolved tree and bumps@protobufjs/utf8to 1.1.2. No application source changes—dependency resolution only.Reviewed by Cursor Bugbot for commit 803e1b5. Bugbot is set up for automated code reviews on this repo. Configure here.