R11DT-4052 - Bump vulnerable deps in swagger-ui (dompurify, js-yaml, form-data) - #205
Merged
Conversation
Force patched versions to fix three advisories: - dompurify =3.4.11 (GHSA-cmwh-pvxp-8882, Moderate - permanent ALLOWED_ATTR pollution via setConfig bypassing the hook clone-guard -> stored XSS) - js-yaml =4.2.0 (GHSA-h67p-54hq-rp68, CVE-2026-53550, Moderate - quadratic-complexity DoS in merge-key handling via repeated aliases) - form-data >=4.0.6 via override (GHSA-hmw2-7cc7-3qxx, CVE-2026-12143, High - CRLF injection via unescaped multipart field/file names) - @istanbuljs/load-nyc-config > js-yaml >=3.15.0 via override (dev-only nested copy, same js-yaml advisory) form-data is a transitive dependency (not in `dependencies`), so it can only be pinned via a scoped npm override, unlike the direct deps dompurify/js-yaml whose version lines were bumped directly. npm audit clean for all three packages. Rebuilt dist bundles.
mvios
requested review from
OS-alexandretome,
OS-joaomurgeiro,
OS-luisvendrame,
OS-miguelfreitas,
OS-thiagosiqueira,
Copilot,
osjlopes and
rmb-guerra
and removed request for
a team
July 2, 2026 11:17
There was a problem hiding this comment.
Pull request overview
This PR updates swagger-ui’s dependency tree to remediate reported npm vulnerabilities by bumping direct dependency pins and adding npm overrides for transitive/dev-only vulnerable packages, with corresponding package-lock.json and dist/ regeneration updates.
Changes:
- Bump direct dependencies:
dompurifyto=3.4.11andjs-yamlto=4.2.0. - Add npm
overridesfor transitiveform-dataand dev-only nestedjs-yamlunder@istanbuljs/load-nyc-config. - Refresh
package-lock.jsonresolutions and updatedist/license metadata + cache-busting query params indist/index.html.
Reviewed changes
Copilot reviewed 1 out of 11 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| package.json | Updates direct dependency pins and adds npm overrides for transitive/dev-only vulnerable deps. |
| package-lock.json | Reflects new resolved versions for bumped/pinned/overridden packages. |
| dist/swagger-ui-standalone-preset.js.LICENSE.txt | Updates embedded js-yaml license/version metadata after rebuild. |
| dist/swagger-ui-es-bundle.js.LICENSE.txt | Updates embedded dompurify and js-yaml license/version metadata after rebuild. |
| dist/swagger-ui-bundle.js.LICENSE.txt | Updates embedded dompurify and js-yaml license/version metadata after rebuild. |
| dist/index.html | Updates bundle cache-busting query params to match rebuilt dist/ assets. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "@swagger-api/apidom-reference": { | ||
| "brace-expansion": ">=5.0.6" | ||
| }, | ||
| "form-data": ">=4.0.6", |
Author
There was a problem hiding this comment.
Instead of adding the form-data and instanbuljs' versions, I ran "npm update form-data" and "npm update js-yaml", as per @rmb-guerra suggestion. The result in package-lock.json is the same.
…build bundles Replace the scoped npm overrides from the previous commit with in-place transitive updates. The patched releases are the newest in-range for every parent, so overrides aren't needed - the floor is captured in package-lock.json: - remove the form-data and @istanbuljs/load-nyc-config overrides - npm update form-data -> form-data 4.0.6 - npm update js-yaml -> dev-only nested js-yaml 3.14.2 -> 3.15.0 Resolved versions are unchanged (form-data 4.0.6, js-yaml 4.2.0, dompurify 3.4.11, nested dev js-yaml 3.15.0). npm audit clean for all three; lockfile in sync; dist bundles regenerated.
osjlopes
approved these changes
Jul 2, 2026
OS-alexandretome
approved these changes
Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Patches three npm vulnerabilities in the swagger-ui dependency tree (b11 / 5.18.2):
dompurifyjs-yamlform-datanpm update js-yamladditionally lifts the dev-only nested copy under@istanbuljs/load-nyc-configfrom3.14.2->3.15.0(affected by the same js-yaml advisory; that package pinsjs-yaml ^3.13.1, so it stays on the patched 3.x backport).Approach
dompurifyandjs-yamlare direct dependencies — the exact pins independencieswere bumped (=3.4.0->=3.4.11,=4.1.1->=4.2.0).form-datais a transitive dependency (not independencies). Its parent ranges already permit the patched release, so it was updated in place withnpm update form-data— nooverridesentry required. The floor is captured inpackage-lock.json.Verification
package-lock.jsonresolvesdompurify@3.4.11,js-yaml@4.2.0(+ nested dev3.15.0),form-data@4.0.6; no vulnerable copies remain.npm auditreports form-data / dompurify / js-yaml all clean.dist/bundles rebuilt;dompurify@3.4.11confirmed embedded.Platform-side bundle update: companion PR OutSystems/Platform#12445.