[trotterdylan]

Implements BB-269 and BB-270.

Bumps the dompurify override in plugins/diff-explorer from 3.4.16 to 3.4.17, which fixes GHSA-cg2g-xh64-v4q7 (critical; Dependabot alerts #3 and #6) and GHSA-mrv2-3pqr-j5jr (high; alerts #2 and #5). No dompurify below 3.4.17 remains in package.json, package-lock.json or pnpm-lock.yaml.

Merging to bb-plugins main moves the pin, builds a new bb-server image and stages a restart for every developer's server. This merge restarts every developer's server (including this one) once they press Restart now, or in the 03:00–05:00 US Eastern quiet window.

Classification

no-review: dependency patch bump in a plugin that is not deployed in the bb-server image; no owner-reviewed trigger matches.

What changes

• plugins/diff-explorer/package.json: overrides.dompurify 3.4.16 → 3.4.17.
• plugins/diff-explorer/package-lock.json: node_modules/dompurify version/resolved/integrity → 3.4.17, and monaco-editor's transitive range → 3.4.17.
• plugins/diff-explorer/pnpm-lock.yaml: regenerated with pnpm install --lockfile-only; override, package snapshot and monaco-editor's edge → 3.4.17.
• plugins/diff-explorer/pnpm-workspace.yaml: the pnpm override 3.4.16 → 3.4.17 (pnpm reads overrides from here, so the lock would otherwise stay at 3.4.16).

No other dependency versions change.

Testing

• pnpm install --frozen-lockfile: pass.
• node scripts/check-dependencies.mjs: pass.
• pnpm run typecheck: pass.
• pnpm test: pass (32 tests).
• pnpm audit --audit-level=high and npm audit --audit-level=high: 0 vulnerabilities.

[trotterdylan]

Independent review running in bb thread @thread:thr_x3qk78biiu.

— from bb thread thr_cbyxwazjfk

[trotterdylan]

Review round 1 (Claude Opus 5.5, at 294c389)

Owner review required: no — none of the owner-reviewed triggers apply. This is a patch bump of an existing dompurify override in diff-explorer, which is not deployed in the bb-server image, and it does not change behaviour. bb stewards gate matches the decide-list entry "A new dependency" (decide: project) only by path (package.json, package-lock.json). No new package is added, and if that entry were counted, it is still the project steward's to approve, not the owner's.

Checked

• Diff: four files, all under plugins/diff-explorer. overrides.dompurify goes from 3.4.16 to 3.4.17 in package.json and pnpm-workspace.yaml, which pnpm reads overrides from. Both lockfiles follow. No other package, version or integrity changes.
• package-lock.json: the 3.4.17 integrity matches the registry (npm view dompurify@3.4.17 dist.integrity). The monaco-editor edge 3.4.15 → 3.4.17 is what npm itself writes. I regenerated the lock from package.json in a temp copy with npm install --package-lock-only (npm 10.9.9) and got a byte-identical file. npm ci there installs dompurify@3.4.17 overridden under monaco-editor@0.57.0.
• Advisories: GHSA-cg2g-xh64-v4q7 (critical, >= 3.4.4, <= 3.4.16) and GHSA-mrv2-3pqr-j5jr (high, <= 3.4.16) both list 3.4.17 as the first patched version.
• Ran in plugins/diff-explorer (pnpm 10.34.6, Node 22.23.3): pnpm install --frozen-lockfile passed and rebuilt the Monaco assets; they are gitignored and the tree stayed clean. node scripts/check-dependencies.mjs passed. pnpm run typecheck passed. pnpm test passed (32/32). pnpm ls dompurify shows only 3.4.17. pnpm audit --audit-level=high found no known vulnerabilities.
• CI: the diff-explorer workflow (quality_checks) and every plugins matrix job are green at 294c389. diff-explorer has its own workflow, so CI did cover it, and I ran it locally too.
• Verified against ticket:
  1. grep dompurify over package.json, package-lock.json and pnpm-lock.yaml shows only 3.4.17. pnpm-workspace.yaml also shows only 3.4.17. Met.
  2. Tests and typecheck pass locally and CI is green. Met.
  3. No other dependency versions change. Met.
• BB-270 (GHSA-mrv2-3pqr-j5jr) is fixed by the same version, so carrying it in this PR is correct.

— from bb thread thr_x3qk78biiu

[trotterdylan]

Merged: no-review lane, reviewer approved 294c389, checks green.
merge commit 0204925
Note: merging this moves the pin and stages a restart for every developer's server (Restart now, or in the 03:00–05:00 ET quiet window).
dispatched bb-server.yaml on bitcomplete/bb-gate@main

[trotterdylan]

Merged: no-review lane, reviewer approved 294c389, checks green.
merge commit 0204925
Note: merging this moves the pin and stages a restart for every developer's server (Restart now, or in the 03:00–05:00 ET quiet window).
dispatched bb-server.yaml on bitcomplete/bb-gate@main