From 724c56b2c8a21fcc6956ba64ea65f7e20e87c784 Mon Sep 17 00:00:00 2001 From: mvios Date: Thu, 30 Jul 2026 15:19:19 +0100 Subject: [PATCH 1/2] R11DT-4120 - Bump vulnerable deps in swagger-ui (immutable, dompurify, js-yaml, axios, brace-expansion) Remediate all 16 Wiz dependency findings by bumping the 5 flagged components, regenerating package-lock.json, and rebuilding the vendored dist/ bundles. Direct dependencies: - immutable =3.8.3 -> =4.3.9 (CVE-2026-59879, CVE-2026-59880) - dompurify =3.4.11 -> =3.4.12 (GHSA-c2j3-45gr-mqc4) - js-yaml =4.2.0 -> =4.3.0 (CVE-2026-59869) Transitive (npm overrides): - axios >=1.16.0 -> >=1.18.0 (resolves 1.18.1; GHSA-gcfj-64vw-6mp9, GHSA-mwf2-3pr3-8698, GHSA-42h9-826w-cgv3, GHSA-xj6q-8x83-jv6g, GHSA-mmx7-hfxf-jppx, GHSA-7q8q-rj6j-mhjq, GHSA-pmv8-rq9r-6j72, GHSA-jqh4-m9w3-8hp9, GHSA-hcpx-6fm6-wx23, GHSA-f4gw-2p7v-4548) - @swagger-api/apidom-reference > brace-expansion >=5.0.6 -> >=5.0.8 (resolves 5.0.8; CVE-2026-13149, CVE-2026-14257) Rebuilt dist/ bundles (Platform vendors the prebuilt artifacts). Verified: npm audit clears all 16 Wiz-flagged instances; Jest unit suite shows no new failures vs baseline (34 pre-existing failures identical with old and new deps); rebuilt bundles pass syntax integrity + branding-asset checks. Out of scope (pre-existing, not Wiz-flagged, not shipped in dist): sass' build-time immutable@5.1.5 and dev-tooling brace-expansion 1.x/2.x copies remain flagged by npm audit; left untouched per surgical scope. --- dist/index.html | 4 +- dist/swagger-ui-bundle.js | 2 +- dist/swagger-ui-bundle.js.LICENSE.txt | 4 +- dist/swagger-ui-es-bundle-core.js | 2 +- dist/swagger-ui-es-bundle.js | 2 +- dist/swagger-ui-es-bundle.js.LICENSE.txt | 4 +- dist/swagger-ui-standalone-preset.js | 2 +- ...wagger-ui-standalone-preset.js.LICENSE.txt | 2 - dist/swagger-ui.js | 2 +- package-lock.json | 42 +++++++++---------- package.json | 10 ++--- 11 files changed, 34 insertions(+), 42 deletions(-) diff --git a/dist/index.html b/dist/index.html index 0809981c079..d6980fd0f6f 100644 --- a/dist/index.html +++ b/dist/index.html @@ -49,8 +49,8 @@
- - + + +