Repository navigation
R11DT-4173 - Bump vulnerable deps in swagger-ui (js-yaml, dompurify, brace-expansion) - #207
Merged
Conversation
…brace-expansion) Remediate three unresolved dependency findings against the fork by bumping each affected component to its patched version, regenerating package-lock.json, and rebuilding the vendored dist/ bundles. All three are patch-level bumps within the same major/minor line, so no src/ changes are required (contrast R11DT-4120's immutable v3->v4 migration). Direct dependencies: - js-yaml =4.3.0 -> =4.3.1 (GHSA-5p4m-2wfm-xmqj; !!omap O(n^2) DoS) - dompurify =3.4.12 -> =3.4.13 (GHSA-55q2-fjhq-7xh7; sanitization-hook XSS) Transitive (npm overrides): - @swagger-api/apidom-reference > brace-expansion >=5.0.8 -> >=5.0.9 (resolves 5.0.9; CVE-2026-69152 DoS, bypass of the CVE-2026-14257 fix) Rebuilt dist/ bundles (Platform vendors the prebuilt artifacts); dist/index.html cache-busting suffixes refreshed. Verified: npm audit (--omit=dev / production scope) clears all three advisories (0 prod vulnerabilities); rebuilt swagger-ui-bundle.js embeds dompurify 3.4.13; jsdom render smoke passes (SwaggerUIBundle constructs and renders spec); no src/ changes. Source maps are byte-identical (equal-length version swaps, no src edits). Out of scope (pre-existing, not shipped in dist): dev-tooling js-yaml 3.15.0 (jest) and brace-expansion 1.x/2.x copies remain; left untouched per surgical scope.
mvios
requested review from
OS-alexandretome,
OS-joaomurgeiro,
OS-josecunha,
OS-miguelfreitas,
OS-thiagosiqueira,
osjlopes and
rmb-guerra
and removed request for
a team
August 14, 2026 09:46
rmb-guerra
approved these changes
Aug 14, 2026
OS-alexandretome
approved these changes
Aug 14, 2026
osjlopes
approved these changes
Aug 14, 2026
This was referenced Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediates three unresolved dependency vulnerabilities flagged against the OutSystems
swagger-uifork (
b11) via surgical patch-level bumps, a regenerated lockfile, and rebuilt vendoreddist/bundles. All three fixes are patch releases within the same major/minor line, so no
src/changesare required (contrast the immutable v3→v4 migration in #206 / R11DT-4120).
Jira: R11DT-4173
Changes
Direct dependencies (
package.json):=4.3.0=4.3.1!!omapO(n²))=3.4.12=3.4.13Transitive (npm
overrides):@swagger-api/apidom-reference→ brace-expansion>=5.0.8>=5.0.9Regenerated
package-lock.jsonand rebuiltdist/bundles (Platform vendors the prebuiltartifacts).
dist/index.htmlcache-busting suffixes refreshed by the build.Verification
npm audit --omit=dev(production scope) → 0 vulnerabilities; all three advisories absent.(Note:
security-audit:prodwrappernpm-audit-ci-wrapperis broken on Windows + Node 20 withspawn EINVAL— unmaintained tool, unrelated to this change; verified vianpm auditdirectly.)^4.1.0js-yamlconsumers dedupe onto
4.3.1; apidombrace-expansionresolves to5.0.9.swagger-ui-bundle.jsembedsdompurify version="3.4.13".SwaggerUIBundleconstructs and renders a representative spec (title +operation) — no runtime regression.
git diff --name-only src/empty — no source changes.src/edits).Render parity is authoritatively gated by Platform's
RESTService_swaggerUiTestsgoldencomparisons, which run on the paired Platform PR (browser tests deferred to CI, mirroring #206).
Out of scope
Pre-existing, non-shipped
npm auditnoise: dev-toolingjs-yaml@3.15.0(jest) andbrace-expansion1.x/2.x copies (eslint/rimraf/babel tooling) are not shipped indist/and areleft untouched per surgical scope.
Related
#205 (R11DT-4052)