[TikiWiki-commits] [Git][tikiwiki/tiki][master] [UPD] Update jsPDF to 4.2.1 and DOMPurify to 3.3.3 to fix npm security advisories

Benoit Grégoire pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
4f17428b by Espoir Baraka at 2026-04-22T15:27:33+00:00
[UPD] Update jsPDF to 4.2.1 and DOMPurify to 3.3.3 to fix npm security advisories
---
* [UPD] Update jsPDF to 4.2.1 and DOMPurify to 3.3.3 to fix npm security advisories

See merge request tikiwiki/tiki!9877

- - - - -


4 changed files:

- package-lock.json
- package.json
- src/js/common-externals/package.json
- src/js/common-reexported/package.json


Changes:

=====================================
package-lock.json
=====================================
@@ -3591,13 +3591,6 @@
                 "prosemirror-view": "^1.18.7"
             }
         },
-        "node_modules/@toast-ui/editor/node_modules/dompurify": {
-            "version": "2.5.9",
-            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.5.9.tgz",
-            "integrity": "sha512-i6mvVmWN4xo9LrhCOZrDgSs9noW6nOahbrmzjRbPF36YPyj5Ue5lgok0MHDWkG7xzpWFO2OYttXdzM7rJxHvNA==",
-            "dev": true,
-            "license": "(MPL-2.0 OR Apache-2.0)"
-        },
         "node_modules/@turf/area": {
             "version": "7.3.4",
             "resolved": "https://registry.npmjs.org/@turf/area/-/area-7.3.4.tgz",
@@ -7866,9 +7859,9 @@
             "license": "MIT"
         },
         "node_modules/dompurify": {
-            "version": "3.3.1",
-            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz",
-            "integrity": "sha512-qkdCKzLNtrgPFP1Vo+98FRzJnBRGe4ffyCea9IwHB1fyxPOeNTHpLKYGd4Uk9xvNoH0ZoOjwZxNptyMwqrId1Q==",
+            "version": "3.3.3",
+            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz",
+            "integrity": "sha512-Oj6pzI2+RqBfFG+qOaOLbFXLQ90ARpcGG6UePL82bJLtdsa6CYJD7nmiU8MW9nQNOtCHV3lZ/Bzq1X0QYbBZCA==",
             "devOptional": true,
             "license": "(MPL-2.0 OR Apache-2.0)",
             "optionalDependencies": {
@@ -11167,10 +11160,11 @@
             }
         },
         "node_modules/jspdf": {
-            "version": "4.2.0",
-            "resolved": "https://registry.npmjs.org/jspdf/-/jspdf-4.2.0.tgz",
-            "integrity": "sha512-hR/hnRevAXXlrjeqU5oahOE+Ln9ORJUB5brLHHqH67A+RBQZuFr5GkbI9XQI8OUFSEezKegsi45QRpc4bGj75Q==",
+            "version": "4.2.1",
+            "resolved": "https://registry.npmjs.org/jspdf/-/jspdf-4.2.1.tgz",
+            "integrity": "sha512-YyAXyvnmjTbR4bHQRLzex3CuINCDlQnBqoSYyjJwTP2x9jDLuKDzy7aKUl0hgx3uhcl7xzg32agn5vlie6HIlQ==",
             "license": "MIT",
+            "peer": true,
             "dependencies": {
                 "@babel/runtime": "^7.28.6",
                 "fast-png": "^6.2.0",
@@ -14937,7 +14931,7 @@
                 "browser-fs-access": "0.38.0",
                 "elix": "15.0.1",
                 "i18next": "25.7.4",
-                "jspdf": "4.0.0",
+                "jspdf": "4.2.1",
                 "pathseg": "1.2.1",
                 "svg2pdf.js": "2.7.0"
             },
@@ -14974,19 +14968,19 @@
             }
         },
         "node_modules/svgedit/node_modules/jspdf": {
-            "version": "4.0.0",
-            "resolved": "https://registry.npmjs.org/jspdf/-/jspdf-4.0.0.tgz",
-            "integrity": "sha512-w12U97Z6edKd2tXDn3LzTLg7C7QLJlx0BPfM3ecjK2BckUl9/81vZ+r5gK4/3KQdhAcEZhENUxRhtgYBj75MqQ==",
+            "version": "4.2.1",
+            "resolved": "https://registry.npmjs.org/jspdf/-/jspdf-4.2.1.tgz",
+            "integrity": "sha512-YyAXyvnmjTbR4bHQRLzex3CuINCDlQnBqoSYyjJwTP2x9jDLuKDzy7aKUl0hgx3uhcl7xzg32agn5vlie6HIlQ==",
             "license": "MIT",
             "dependencies": {
-                "@babel/runtime": "^7.28.4",
+                "@babel/runtime": "^7.28.6",
                 "fast-png": "^6.2.0",
                 "fflate": "^0.8.1"
             },
             "optionalDependencies": {
                 "canvg": "^3.0.11",
                 "core-js": "^3.6.0",
-                "dompurify": "^3.2.4",
+                "dompurify": "^3.3.1",
                 "html2canvas": "^1.0.0-rc.5"
             }
         },
@@ -16925,7 +16919,7 @@
                 "codemirror": "^5.65.17",
                 "converse.js": "^12.0.0",
                 "d3-milestones": "^1.5.0",
-                "dompurify": "3.3.1",
+                "dompurify": "3.3.3",
                 "driver.js": "^1.3.1",
                 "fieldslinker": "^1.0.4",
                 "fitvids": "^2.1.1",
@@ -16974,7 +16968,38 @@
             "version": "1.0.0",
             "license": "ISC",
             "devDependencies": {
-                "jspdf": "^4.0.0"
+                "jspdf": "^4.2.1"
+            }
+        },
+        "src/js/common-reexported/node_modules/core-js": {
+            "version": "3.49.0",
+            "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.49.0.tgz",
+            "integrity": "sha512-es1U2+YTtzpwkxVLwAFdSpaIMyQaq0PBgm3YD1W3Qpsn1NAmO3KSgZfu+oGSWVu6NvLHoHCV/aYcsE5wiB7ALg==",
+            "dev": true,
+            "hasInstallScript": true,
+            "license": "MIT",
+            "optional": true,
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/core-js"
+            }
+        },
+        "src/js/common-reexported/node_modules/jspdf": {
+            "version": "4.2.1",
+            "resolved": "https://registry.npmjs.org/jspdf/-/jspdf-4.2.1.tgz",
+            "integrity": "sha512-YyAXyvnmjTbR4bHQRLzex3CuINCDlQnBqoSYyjJwTP2x9jDLuKDzy7aKUl0hgx3uhcl7xzg32agn5vlie6HIlQ==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "@babel/runtime": "^7.28.6",
+                "fast-png": "^6.2.0",
+                "fflate": "^0.8.1"
+            },
+            "optionalDependencies": {
+                "canvg": "^3.0.11",
+                "core-js": "^3.6.0",
+                "dompurify": "^3.3.1",
+                "html2canvas": "^1.0.0-rc.5"
             }
         },
         "src/js/jquery-tiki": {


=====================================
package.json
=====================================
@@ -114,17 +114,24 @@
         "vitest" : "https://github.com/vitest-dev/vitest/releases"
     },
     "overrides" : {
-        "dompurify" : "3.3.1"
+        "dompurify" : "3.3.3",
+        "jspdf" : "4.2.1",
+        "svgedit" : {
+            "jspdf" : "4.2.1"
+        }
     },
     "overridesComment" : {
+        "jspdf": [
+            "npm audit flagged jspdf <= 4.2.0 (critical). Pin 4.2.1 so the root install and svgedit (nested 4.0.0) resolve to a patched release."
+        ],
         "dompurify": [
-            "This override forces all packages to use DOMPurify v3.3.1 to fix a security vulnerability present in DOMPurify v2.x.",
+            "This override forces all packages to use DOMPurify v3.3.3 to fix security issues present in DOMPurify v2.x and patched releases in the v3 line.",
             "Upgrading from v2 to v3 is safe for our project because we do not support Internet Explorer (IE).",
             "As noted by Victor Buzinaro in https://github.com/cure53/DOMPurify/issues/785, the only breaking change introduced in v3 is the removal of IE-specific support.",
             "After reviewing the changes between versions 2.5.8 and 3.3.0 (https://github.com/cure53/DOMPurify/compare/2.5.8...3.3.0), we confirmed there are no functional breaking changes that affect our usage.",
             "Toast UI Editor currently depends on DOMPurify v2.x, but its DOMPurify integration",
             "(introduced in https://github.com/nhn/tui.editor/commit/6e5730914902071b54c529673e964a24b58e3eec#diff-e70b3ac7e7e963527907ae78c682a077c1b87015783bdcb150084e023ce17528) is compatible with v3.",
-            "For this reason, enforcing DOMPurify v3.2.7 is safe for us. We should remove this override once @toast-ui/editor officially updates to DOMPurify v3 or when we replace/fork it with a maintained version compatible with v3."
+            "For this reason, enforcing DOMPurify v3.3.x is safe for us. Remove this override when upstream packages pin a secure DOMPurify without conflicts."
         ]
     },
     "workspaces": [


=====================================
src/js/common-externals/package.json
=====================================
@@ -24,7 +24,7 @@
     "codemirror": "^5.65.17",
     "converse.js": "^12.0.0",
     "d3-milestones": "^1.5.0",
-    "dompurify": "3.3.1",
+    "dompurify": "3.3.3",
     "driver.js": "^1.3.1",
     "fieldslinker": "^1.0.4",
     "fitvids": "^2.1.1",


=====================================
src/js/common-reexported/package.json
=====================================
@@ -12,6 +12,6 @@
   "jspdf" : "ESM module is not directly usable.  NOTE:  Depends on html2canvas, but remapped to html2canvas-pro in vite.config.js)"
   },
   "devDependencies":{
-  "jspdf" : "^4.0.0"
+  "jspdf" : "^4.2.1"
   }
 }



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/4f17428bf8a474657dffbc184a65a30d1be1cabf

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/4f17428bf8a474657dffbc184a65a30d1be1cabf
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs