fix: zero npm audit vulns via dompurify override (#175)#222
Closed
EVWorth wants to merge 1 commit into
Closed
Conversation
monaco-editor 0.55.1 hard-pins dompurify 3.2.7 in its package.json
('dompurify': '3.2.7'). That version has 16+ open advisories
(mutation-XSS, prototype pollution, ADD_TAGS predicate bypass, hook
pollution, IN_PLACE realm confusion, SAFE_FOR_TEMPLATES bypass,
et al.). 'npm audit fix --force' tried to downgrade monaco-editor to
0.53.0 to escape the chain - losing ~6 months of monaco improvements
(HTML rendering, marked 14, accessibility) for a transitive dep we
never invoke at runtime.
SQLPilot doesn't use monaco's diff editor (the only path that
exercises dompurify at runtime in the ESM build Vite consumes).
Override dompurify to ^3.4.11 at the npm level:
"overrides": { "dompurify": "^3.4.11" }
Vite bundles monaco's ESM build (./esm/vs/editor/editor.main.js),
which imports dompurify as an external module. The override flows
through to the production bundle. The vendored 3.2.7 copy inside
monaco-editor/min/vs/editor.api-*.js (legacy CJS bundle) is not used
in our build path - only relevant if a downstream consumer were to
require() monaco.
What this fixes:
- DOMPurify XSS chain (GHSA-v2wj-7wpq-c8vv + 15 sibling GHSAs)
- 'npm audit' on this branch: 0 vulnerabilities (was 2 prod + 3 dev)
What this does NOT touch:
- cargo audit: already passing via scripts/cargo-audit-check.sh
design (0 real vulnerabilities, 17 non-blocking
unmaintained/unsound warnings via gtk-rs + unic-* + glib -
tracked in #204/#206).
- KNOWN_ACCEPTED list in cargo-audit-check.sh unchanged
(still 2 quick-xml DoS awaiting wayland-rs release per #206).
- 'npm run deps:check' 5 cargo deps-too-new failure: pre-existing
on main, unrelated to this PR. Same Cargo.lock entries on main
also fail the gate. Out of scope here.
Closes #175.
This was referenced Jul 19, 2026
Owner
Author
|
Superseded by PR #224 ( The cargo dep-age gate failure (5 cargo deps <7d old, from #205) is unrelated and tracked in #223. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Eliminates the 2 remaining npm audit vulnerabilities (16 advisory chain on DOMPurify <=3.4.10) without downgrading monaco-editor.
Why
monaco-editor@0.55.1 hard-pins
dompurify: 3.2.7in its package.json. That version has known XSS / prototype-pollution / hook-pollution / SAFE_FOR_TEMPLATES-bypass / IN_PLACE-realm-confusion advisories (one GHSA umbrella + 15 sibling GHSAs, all chained viaGHSA-v2wj-7wpq-c8vvfamily).npm audit fix --force's only resolution was to roll monaco-editor backward to 0.53.0 - losing ~6 months of monaco improvements (HTML rendering, marked 14, accessibility, etc.) - for a transitive dep we never invoke at runtime in SQLPilot.How
monaco-editorships two builds:./esm/vs/editor/editor.main.js- consumed by Vite (our build path) - importsdompurifyas an external module../min/vs/editor/editor.main.js(CJS) + a vendored 3.2.7 copy insidemin/vs/editor.api-*.js- the legacy CJS bundle, NOT used by our build.SQLPilot uses the ESM build via Vite. Override dompurify at the npm level:
The override forces npm to install dompurify@3.4.12 (latest) at the workspace root. monaco's ESM import resolves to this version, and Vite bundles it into the production output.
Verified:
npm auditreturns 0 vulnerabilities after the override.Diff (2 files, +116/-110)
package.jsonoverridesblock pinning dompurify to ^3.4.11package-lock.jsonnpm install; resolves dompurify 3.4.12 at workspace root, no nested copy under monaco-editorWhat's NOT in this PR
scripts/cargo-audit-check.shexits 0 today (0 real vulns, 17 non-blocking unmaintained/unsound warnings on gtk-rs + unic-* + glib). KNOWN_ACCEPTED list holds 2 quick-xml advisories awaiting wayland-rs release (#206).npm run deps:check: pre-existing failure on main for 5 cargo deps that landed <7 days ago (serde 1.0.229, tokio 1.53.0, uuid 1.24.0, anyhow 1.0.104, futures 0.3.33). Same Cargo.lock entries on main also fail the gate. Not introduced by this PR; flagging as a follow-up item since it would block any PR touchingpackage.json/package-lock.jsonuntil those versions age.Verification
npm auditnpm run build(Vite)npx vitest runnpm run type-checkCloses #175.