From 236667545355004075dab372c321d909320872f7 Mon Sep 17 00:00:00 2001 From: mvios Date: Thu, 2 Jul 2026 12:15:36 +0100 Subject: [PATCH 1/2] R11DT-4052 - Bump vulnerable deps in swagger-ui (security) Force patched versions to fix three advisories: - dompurify =3.4.11 (GHSA-cmwh-pvxp-8882, Moderate - permanent ALLOWED_ATTR pollution via setConfig bypassing the hook clone-guard -> stored XSS) - js-yaml =4.2.0 (GHSA-h67p-54hq-rp68, CVE-2026-53550, Moderate - quadratic-complexity DoS in merge-key handling via repeated aliases) - form-data >=4.0.6 via override (GHSA-hmw2-7cc7-3qxx, CVE-2026-12143, High - CRLF injection via unescaped multipart field/file names) - @istanbuljs/load-nyc-config > js-yaml >=3.15.0 via override (dev-only nested copy, same js-yaml advisory) form-data is a transitive dependency (not in `dependencies`), so it can only be pinned via a scoped npm override, unlike the direct deps dompurify/js-yaml whose version lines were bumped directly. npm audit clean for all three packages. Rebuilt dist bundles. --- dist/index.html | 4 +- dist/swagger-ui-bundle.js | 2 +- dist/swagger-ui-bundle.js.LICENSE.txt | 4 +- dist/swagger-ui-es-bundle-core.js | 2 +- dist/swagger-ui-es-bundle.js | 2 +- dist/swagger-ui-es-bundle.js.LICENSE.txt | 4 +- dist/swagger-ui-standalone-preset.js | 2 +- ...wagger-ui-standalone-preset.js.LICENSE.txt | 2 +- dist/swagger-ui.js | 2 +- package-lock.json | 53 ++++++++++++------- package.json | 8 ++- 11 files changed, 52 insertions(+), 33 deletions(-) diff --git a/dist/index.html b/dist/index.html index bcf6bc18752..3e07e082ef7 100644 --- a/dist/index.html +++ b/dist/index.html @@ -49,8 +49,8 @@
- - + + +