From bbd02fcb8a45cbf82266dfd16b951ba65e19a0ec Mon Sep 17 00:00:00 2001 From: tomas Date: Thu, 22 Oct 2026 20:07:01 +0000 Subject: [PATCH] chore(deps): resolve dompurify and ip-address vulnerabilities - dompurify 3.4.16 -> 3.4.17 (lockfile-only): GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f. mermaid declares ^3.3.3 and no override pins dompurify. - ip-address override 10.7.3 -> 10.7.4: GHSA-rxp7-6hxx-x8q5. The exact override is what holds the tree on 10.7.3, and build.ts propagates it into the shipped dist/sql-lsp-modules install. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CqyiyR2czV5oi4Y4bu76FS --- package-lock.json | 12 ++++++------ package.json | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package-lock.json b/package-lock.json index a952a3a4c..71e8a475d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -15587,9 +15587,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.16", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz", - "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==", + "version": "3.4.17", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz", + "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -19375,9 +19375,9 @@ "integrity": "sha512-B3ex30927698TJENHR++8FfEaJGqoWOgI6ZY5Ht/nLUsFCwHn6akbwtnUAPCgUepAnTpe2qHxhDNjoKLyz6rgQ==" }, "node_modules/ip-address": { - "version": "10.7.3", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.3.tgz", - "integrity": "sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg==", + "version": "10.7.4", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz", + "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==", "license": "MIT", "optional": true, "engines": { diff --git a/package.json b/package.json index bc837871c..6b20c864c 100644 --- a/package.json +++ b/package.json @@ -3004,7 +3004,7 @@ "serialize-javascript@<7.0.5": "7.0.5", "flatted@<3.4.2": "3.4.2", "yaml": "2.8.3", - "ip-address": "10.7.3", + "ip-address": "10.7.4", "mermaid": "11.16.1", "postcss": "$postcss", "sanitize-html": "2.18.1",