From c06677bf40b0b607ff806966f56e9510d7ddaae9 Mon Sep 17 00:00:00 2001 From: mvios Date: Fri, 14 Aug 2026 10:41:03 +0100 Subject: [PATCH] R11DT-4173 - Bump vulnerable deps in swagger-ui (js-yaml, dompurify, brace-expansion) Remediate three unresolved dependency findings against the fork by bumping each affected component to its patched version, regenerating package-lock.json, and rebuilding the vendored dist/ bundles. All three are patch-level bumps within the same major/minor line, so no src/ changes are required (contrast R11DT-4120's immutable v3->v4 migration). Direct dependencies: - js-yaml =4.3.0 -> =4.3.1 (GHSA-5p4m-2wfm-xmqj; !!omap O(n^2) DoS) - dompurify =3.4.12 -> =3.4.13 (GHSA-55q2-fjhq-7xh7; sanitization-hook XSS) Transitive (npm overrides): - @swagger-api/apidom-reference > brace-expansion >=5.0.8 -> >=5.0.9 (resolves 5.0.9; CVE-2026-69152 DoS, bypass of the CVE-2026-14257 fix) Rebuilt dist/ bundles (Platform vendors the prebuilt artifacts); dist/index.html cache-busting suffixes refreshed. Verified: npm audit (--omit=dev / production scope) clears all three advisories (0 prod vulnerabilities); rebuilt swagger-ui-bundle.js embeds dompurify 3.4.13; jsdom render smoke passes (SwaggerUIBundle constructs and renders spec); no src/ changes. Source maps are byte-identical (equal-length version swaps, no src edits). Out of scope (pre-existing, not shipped in dist): dev-tooling js-yaml 3.15.0 (jest) and brace-expansion 1.x/2.x copies remain; left untouched per surgical scope. --- dist/index.html | 4 ++-- dist/swagger-ui-bundle.js | 2 +- dist/swagger-ui-bundle.js.LICENSE.txt | 2 +- dist/swagger-ui-es-bundle-core.js | 2 +- dist/swagger-ui-es-bundle.js | 2 +- dist/swagger-ui-es-bundle.js.LICENSE.txt | 2 +- dist/swagger-ui-standalone-preset.js | 2 +- dist/swagger-ui.js | 2 +- package-lock.json | 22 +++++++++++----------- package.json | 6 +++--- 10 files changed, 23 insertions(+), 23 deletions(-) diff --git a/dist/index.html b/dist/index.html index 8cce0d70603..ec8af369aef 100644 --- a/dist/index.html +++ b/dist/index.html @@ -49,8 +49,8 @@
- - + +