[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Update DOMPurify version to 3.4.12 and PostCSS version to 8.5.25

Espoir Baraka pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
3a7b2bd4 by Espoir Baraka at 2026-08-07T23:54:31+02:00
[FIX] Update DOMPurify version to 3.4.12 and PostCSS version to 8.5.25
---
* [FIX] Update PostCSS version to 8.5.25 and remove obsolete dependencies in package-lock.json

* [FIX] Update DOMPurify version to 3.4.12

See merge request tikiwiki/tiki!10823

- - - - -


3 changed files:

- package-lock.json
- package.json
- src/js/common-externals/package.json


Changes:

=====================================
package-lock.json
=====================================
@@ -4454,34 +4454,6 @@
                 "yallist": "^2.1.2"
             }
         },
-        "node_modules/@vue/component-compiler-utils/node_modules/postcss": {
-            "version": "8.5.16",
-            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
-            "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
-            "funding": [
-                {
-                    "type": "opencollective",
-                    "url": "https://opencollective.com/postcss/"
-                },
-                {
-                    "type": "tidelift",
-                    "url": "https://tidelift.com/funding/github/npm/postcss"
-                },
-                {
-                    "type": "github",
-                    "url": "https://github.com/sponsors/ai"
-                }
-            ],
-            "license": "MIT",
-            "dependencies": {
-                "nanoid": "^3.3.12",
-                "picocolors": "^1.1.1",
-                "source-map-js": "^1.2.1"
-            },
-            "engines": {
-                "node": "^10 || ^12 || >=14"
-            }
-        },
         "node_modules/@vue/component-compiler-utils/node_modules/postcss-selector-parser": {
             "version": "6.1.4",
             "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
@@ -6687,16 +6659,7 @@
             }
         },
         "node_modules/converse.js/src/log": {
-            "name": "@converse/log",
-            "version": "0.0.1",
-            "dev": true,
-            "license": "MPL-2.0",
-            "devDependencies": {
-                "typescript": "^5.5.4"
-            },
-            "engines": {
-                "node": ">=16.0.0"
-            }
+            "dev": true
         },
         "node_modules/convert-source-map": {
             "version": "2.0.0",
@@ -7802,9 +7765,9 @@
             "license": "MIT"
         },
         "node_modules/dompurify": {
-            "version": "3.4.11",
-            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz",
-            "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==",
+            "version": "3.4.12",
+            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
+            "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
             "devOptional": true,
             "license": "(MPL-2.0 OR Apache-2.0)",
             "optionalDependencies": {
@@ -13112,9 +13075,9 @@
             }
         },
         "node_modules/postcss": {
-            "version": "8.5.26",
-            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
-            "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
+            "version": "8.5.25",
+            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz",
+            "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==",
             "funding": [
                 {
                     "type": "opencollective",
@@ -13131,7 +13094,7 @@
             ],
             "license": "MIT",
             "dependencies": {
-                "nanoid": "^3.3.17",
+                "nanoid": "^3.3.16",
                 "picocolors": "^1.1.1",
                 "source-map-js": "^1.2.1"
             },
@@ -15361,6 +15324,7 @@
             "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
             "devOptional": true,
             "license": "Apache-2.0",
+            "peer": true,
             "bin": {
                 "tsc": "bin/tsc"
             },
@@ -16974,7 +16938,7 @@
                 "codemirror": "^5.65.17",
                 "converse.js": "^12.0.0",
                 "d3-milestones": "^1.5.0",
-                "dompurify": "^3.4.11",
+                "dompurify": "^3.4.12",
                 "driver.js": "^1.3.1",
                 "fieldslinker": "^1.0.4",
                 "fitvids": "^2.1.1",


=====================================
package.json
=====================================
@@ -124,37 +124,36 @@
         "vitest" : "https://github.com/vitest-dev/vitest/releases"
     },
     "overrides" : {
-        "dompurify" : "3.4.11",
+        "dompurify" : "3.4.12",
         "devalue" : "5.8.1",
         "glob" : "10.5.0",
         "svelte" : "5.51.0",
-        "@vue/component-compiler-utils" : {
-            "postcss" : "8.5.16"
-        },
         "jspdf" : "4.2.1",
         "svgedit" : {
             "jspdf" : "4.2.1"
-        }
+        },
+        "postcss" : "8.5.25"
     },
     "overridesComment" : {
         "jspdf": [
             "npm audit flagged jspdf <= 4.2.0 (critical). Pin 4.2.1 so the root install and svgedit (nested 4.0.0) resolve to a patched release."
         ],
+        "postcss": [
+            "vue3-sfc-loader -> @vue/component-compiler-utils still pulls PostCSS 7.0.x (npm audit range <=8.5.17: parsing/XSS/sourceMappingURL issues).",
+            "Force PostCSS 8.5.25 everywhere (already used by Vite). Remove when upstream stops depending on PostCSS 7."
+        ],
         "dompurify": [
-            "This override forces all packages to use DOMPurify v3.x to fix security issues present in DOMPurify v2.x and patched releases in the v3 line.",
+            "This override forces all packages to use DOMPurify v3.4.12 to fix security issues present in DOMPurify v2.x and patched releases in the v3 line.",
             "Upgrading from v2 to v3 is safe for our project because we do not support Internet Explorer (IE).",
             "As noted by Victor Buzinaro in https://github.com/cure53/DOMPurify/issues/785, the only breaking change introduced in v3 is the removal of IE-specific support.",
             "After reviewing the changes between versions 2.5.8 and 3.3.0 (https://github.com/cure53/DOMPurify/compare/2.5.8...3.3.0), we confirmed there are no functional breaking changes that affect our usage.",
             "Toast UI Editor currently depends on DOMPurify v2.x, but its DOMPurify integration",
             "(introduced in https://github.com/nhn/tui.editor/commit/6e5730914902071b54c529673e964a24b58e3eec#diff-e70b3ac7e7e963527907ae78c682a077c1b87015783bdcb150084e023ce17528) is compatible with v3.",
-            "For this reason, enforcing DOMPurify v3.x is safe for us. Pinned to 3.4.11 for npm audit advisories through 3.4.10. Remove this override when upstream packages pin a secure DOMPurify without conflicts."
+            "For this reason, enforcing DOMPurify v3.4.x is safe for us. Pinned to 3.4.12 for npm audit advisories. Remove this override when upstream packages pin a secure DOMPurify without conflicts."
         ],
         "glob": [
             "copy-and-watch pins glob 10.3.12 (vulnerable CLI <=10.4.5). Override to 10.5.0; Tiki uses glob programmatically, not the CLI -c/--cmd flag."
         ],
-        "postcss": [
-            "vue3-sfc-loader pulls @vue/component-compiler-utils with a nested vulnerable postcss. Scoped override to 8.5.16 (build-time SFC compilation only)."
-        ],
         "svelte": [
             "Svelte is pinned to 5.51.0 (and devalue to 5.8.1) for @event-calendar/core 4.x compatibility: Svelte >= 5.51.1 breaks calendar interactions (https://github.com/vkurko/calendar/issues/623). devalue is overridden separately so we can take the npm audit fix without upgrading Svelte. Upgrade path: @event-calendar/core 5.4.1+ then remove both svelte and devalue overrides."
         ]


=====================================
src/js/common-externals/package.json
=====================================
@@ -26,7 +26,7 @@
     "codemirror": "^5.65.17",
     "converse.js": "^12.0.0",
     "d3-milestones": "^1.5.0",
-    "dompurify": "^3.4.11",
+    "dompurify": "^3.4.12",
     "driver.js": "^1.3.1",
     "fieldslinker": "^1.0.4",
     "fitvids": "^2.1.1",



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3a7b2bd450581add52d556e8267d726712c9e636

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3a7b2bd450581add52d556e8267d726712c9e636
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs