chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by dependabot[bot] · Pull Request #779 · launchdarkly/ldcli

dependabot · 2026-08-07T19:40:14Z

Bumps the npm_and_yarn group with 2 updates in the /internal/dev_server/ui directory: dompurify and uuid.

Updates dompurify from 3.2.4 to 3.4.13

Release notes

DOMPurify 3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr

Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG

Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG

Bumped several dependencies where possible

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.11

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs

Bumped vulnerable development dependencies to arrive at plain 0 with npm audit

Updated the osv-scanner suppression list as no vulnerable dependencies are left for now

Updated up the linting tool-chain and removed now-redundant lint directives

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.10

Refactored codebase for clarity: extracted the public type declarations into types.ts

Decomposed the three largest sanitizer functions into focused helpers

Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path

Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML

Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode

Reduced CI cost by running the full three-engine browser suite once per PR

Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

Documented the bench and test:happydom scripts in the README

Completed the Attack Classes & Bypass History wiki page

Bumped several dependencies where possible

DOMPurify 3.4.9

Further improved the handling of Trusted Types config options, thanks @offset

Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb

Added more test coverage for IN_PLACE and Trusted Types related usage

Bumped several dependencies where possible

Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

Cleaned up the repository root, renamed some and removed unneeded files

Fixed an issue with handling of Trusted Types policies, thanks @fulstadev

Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo

Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK

Bumped several dependencies where possible

DOMPurify 3.4.7

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker

... (truncated)

Commits

3067f77 release: 3.4.13 (#1562)
a9ca1e5 release: 3.4.12 (#1537)
0cae518 release: 3.4.11 (#1494)
6ee5716 release: 3.4.10 (#1478)
5210247 release: 3.4.9 (#1459)
bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
bb7739e release: 3.4.6 (#1394)
011b0c7 release: 3.4.5 (#1382)
5817ad9 release: 3.4.4 (#1374)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Removes uuid

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Overview
Updates internal/dev_server/ui dependency resolution via the lockfile only—package.json is unchanged.

DOMPurify is pulled forward from 3.2.4 to 3.4.13 on the transitive path used by @launchpad-ui/markdown (isomorphic-dompurify). That brings in recent sanitization hardening (e.g. IN_PLACE, hooks, DOM clobbering fixes) without any app source edits.

uuid is removed from the resolved tree, so it is no longer installed as a transitive dependency for this UI package.

^{Reviewed by Cursor Bugbot for commit aee99e9. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

…dates Bumps the npm_and_yarn group with 2 updates in the /internal/dev_server/ui directory: [dompurify](https://github.com/cure53/DOMPurify) and [uuid](https://github.com/uuidjs/uuid). Updates `dompurify` from 3.2.4 to 3.4.13 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.2.4...3.4.13) Removes `uuid` --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

semgrep-code-launchdarkly · 2026-08-07T19:42:04Z

@@ -9252,6 +10228,12 @@
      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.7.0.tgz",
      "integrity": "sha512-gLXCKdN1/j47AiHiOkJN69hJmcbGTHI0ImLmbYLHykhgeN0jVGola9yVjFgzCUklsZQMW55o+dW7IXv3RCXDzA=="
    },
+    "node_modules/turbo-stream": {


High severity vulnerability may affect your project—review required:
Line 10231 lists a dependency (turbo-stream) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of react-router and turbo-stream are vulnerable to Allocation of Resources Without Limits or Throttling. React Router Framework Mode uses turbo-stream to serialize loader/action data into Single Fetch responses. The underlying serialization algorithm becomes a bottleneck on certain data shapes, so an attacker who can influence the serialized data can cause excessive resource consumption and a Denial of Service.

References: GHSA, CVE

To resolve this comment:
Check if you use React Router Framework Mode with Single Fetch enabled (the default in v7 Framework Mode, or opt-in via future.unstable_singleFetch in Remix v2.9.0+) and not Declarative or Data mode.

If you're affected, upgrade this dependency to at least version 3.0.0 at internal/dev_server/ui/package-lock.json.

If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

semgrep-code-launchdarkly · 2026-08-07T19:42:05Z

+      "integrity": "sha512-RBvlC0wwmDxyPjA+i1e09KuVQEGcJJz/w/bQ1Hxbz2I4NDetFOvrtIBknRhmO2gBUdOrIkMnYZWiGIjdBcNRVA==",
+      "license": "MIT"
+    },
+    "node_modules/@launchpad-ui/navigation/node_modules/react-router": {


High severity vulnerability may affect your project—review required:
Line 2333 lists a dependency (react-router) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of react-router and turbo-stream are vulnerable to Allocation of Resources Without Limits or Throttling. React Router Framework Mode uses turbo-stream to serialize loader/action data into Single Fetch responses. The underlying serialization algorithm becomes a bottleneck on certain data shapes, so an attacker who can influence the serialized data can cause excessive resource consumption and a Denial of Service.

References: GHSA, CVE

To resolve this comment:
Check if you use React Router Framework Mode with Single Fetch enabled (the default in v7 Framework Mode, or opt-in via future.unstable_singleFetch in Remix v2.9.0+) and not Declarative or Data mode.

If you're affected, upgrade this dependency to at least version 7.14.0 at internal/dev_server/ui/package-lock.json.

If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

- verdict.jq: if each PR finding of a list check (actionlint, golangci-lint, prettier, actions-pinning, npm ls) also occurs on base, the failure is pre-existing. Before, a PR that removed one actionlint finding got a block (#717, #721). - golangci-lint: run with --allow-parallel-runners. A non-zero exit with no finding is incomplete, not a failure with 0 findings. - ui-npm-ci: take the conflict from npm error lines only. An npm warn line named the wrong peer on #729. - deps.py: a package that already had an install script on base adds no new script (esbuild on #779). - ui-dep-usage: join package names with "and". - pr-state: for a conflicting PR, do not say that the checks ran on the PR merged into main. - verify.sh: save the baseline profile. --phase generated and --phase render use it instead of the default profile. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

- pr-disclosure: for a grouped update, or a PR with more than one direct update, list the direct updates that the PR title and body do not name, and ask one decision. #779 names dompurify and uuid, but also moves @launchpad-ui/components, launchdarkly-js-client-sdk, react-router, and vite. - upstream.py: use the from_ref and to_ref from classify. Map golang.org/x/* to the github.com/golang mirror, and use the commit messages as notes when a Go module has no release notes. For npm monorepo packages (react-router, @launchpad-ui/*), read the package CHANGELOG.md and use <name>@<version> tags. - verify.sh --pr-meta FILE: read the PR title and body from a file, for replays that need them without GitHub. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

New fixtures: #717 safe-to-merge (setup-go from v4 and v5), #718 compares release-secrets v1.0.1 with v1.2.0, #721 needs-human with the python-version question, #722 needs-human (not block), and #779 block with the undisclosed updates and no esbuild question. The #831 fixture expects the new wording. The impact-review copies drop notes about the old verifier bugs. replay.sh supports pr_meta, decisions_exclude, and updates expectations. run.sh adds 16 unit tests with stub tools: the findings subset rule, golangci-lint lock contention, npm warn lines, install scripts on base, pr-disclosure, pr-state wording, classify with mixed refs, and actions-coverage with a stub gh. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

Try <name>@<version>, v<version>, and <version>, and use the first tag that exists. vite tags v8.2.1 and launchdarkly-js-client-sdk tags 3.9.5, so #779 got no compare link or notes for them. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

…old image tags - actions_analysis: evaluate defaults as github.com does. A GHES fallback (github.server_url == 'https://github.com' && X || Y) is X, so the setup-python token default is not a change (#721). The question names the workflows that use the action. - license-changes: one item per package family, which says dev-only build tools: "Accept MPL-2.0 for lightningcss 1.33.0 and 11 lightningcss-* package(s) (dev-only build tools)?" (#779). - verdict.jq: a guard regression or a failing gate already shows that a change reaches ldcli, so the missing discriminating proof is not an incomplete item (#723, #729, #779). - release-snapshot: accept a tagged release image. A conflicting PR is tested at its old head, and trees from before #629 use goreleaser-cross:v1.24.2 instead of a digest (#621). Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

New fixtures: #621 (forced x/term update, not grouped, release snapshot on the old tree) and #737 (x/term named only in the Bugbot summary). The #723 fixture expects no audit question and full note coverage. The #779 fixture expects full note coverage, GHSA IDs, and the short license question. The #721 fixture expects no token default in the question. run.sh adds 12 unit tests with stub tools: bot text and <details> in pr-disclosure, forced Go updates, npm audit advisory IDs, note coverage (partial CHANGELOG, missing tag, release scan past 3 pages), the license family question, impact proof with a guard regression, and the govulncheck levels. Each one fails on the code before this change. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

nieblara · 2026-10-19T20:00:55Z

@dependabot rebase

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 7, 2026

dependabot Bot requested a review from a team as a code owner August 7, 2026 19:40

semgrep-code-launchdarkly Bot reviewed Aug 7, 2026

View reviewed changes

devin-ai-integration Bot mentioned this pull request Sep 28, 2026

fix: bump vulnerable minor/patch dependencies (x/net, x/mod, js-yaml, browserslist, source-map-js, dompurify, uuid, react-router, brace-expansion) #823

Open

cursor Bot mentioned this pull request Oct 6, 2026

feat(deps): agent-driven Dependabot PR verifier (phase 1) #849

Draft

2 of 3 tasks

nieblara mentioned this pull request Oct 20, 2026

fix(dev-server-ui): update dompurify and uuid for security advisories #881

Draft

2 of 3 tasks

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates - #779

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates#779
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/internal/dev_server/ui/npm_and_yarn-520b55c506

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading

Uh oh!

semgrep-code-launchdarkly Bot Aug 7, 2026

Uh oh!

semgrep-code-launchdarkly Bot Aug 7, 2026

Uh oh!

nieblara commented Oct 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DOMPurify 3.4.13

DOMPurify 3.4.12

DOMPurify 3.4.11

DOMPurify 3.4.10

DOMPurify 3.4.9

DOMPurify 3.4.8

DOMPurify 3.4.7

Uh oh!

semgrep-code-launchdarkly Bot Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-launchdarkly Bot Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

nieblara commented Oct 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading