Skip to content

R11DT-4052 - Bump vulnerable deps in swagger-ui (dompurify, js-yaml, form-data) - #205

Merged
mvios merged 2 commits into
b11from
R11DT-4052-swagger-ui-vuln-bumps
Jul 2, 2026
Merged

R11DT-4052 - Bump vulnerable deps in swagger-ui (dompurify, js-yaml, form-data)#205
mvios merged 2 commits into
b11from
R11DT-4052-swagger-ui-vuln-bumps

Conversation

@mvios

@mvios mvios commented Jul 2, 2026

Copy link
Copy Markdown

What

Patches three npm vulnerabilities in the swagger-ui dependency tree (b11 / 5.18.2):

Package Was Now Advisory Severity
dompurify 3.4.0 3.4.11 GHSA-cmwh-pvxp-8882 Moderate
js-yaml 4.1.1 4.2.0 GHSA-h67p-54hq-rp68 (CVE-2026-53550) Moderate
form-data 4.0.5 4.0.6 GHSA-hmw2-7cc7-3qxx (CVE-2026-12143) High

npm update js-yaml additionally lifts the dev-only nested copy under @istanbuljs/load-nyc-config from 3.14.2 -> 3.15.0 (affected by the same js-yaml advisory; that package pins js-yaml ^3.13.1, so it stays on the patched 3.x backport).

Approach

  • dompurify and js-yaml are direct dependencies — the exact pins in dependencies were bumped (=3.4.0 -> =3.4.11, =4.1.1 -> =4.2.0).
  • form-data is a transitive dependency (not in dependencies). Its parent ranges already permit the patched release, so it was updated in place with npm update form-data — no overrides entry required. The floor is captured in package-lock.json.

Verification

  • package-lock.json resolves dompurify@3.4.11, js-yaml@4.2.0 (+ nested dev 3.15.0), form-data@4.0.6; no vulnerable copies remain.
  • npm audit reports form-data / dompurify / js-yaml all clean.
  • dist/ bundles rebuilt; dompurify@3.4.11 confirmed embedded.

Platform-side bundle update: companion PR OutSystems/Platform#12445.

Force patched versions to fix three advisories:
- dompurify =3.4.11 (GHSA-cmwh-pvxp-8882, Moderate - permanent
  ALLOWED_ATTR pollution via setConfig bypassing the hook clone-guard
  -> stored XSS)
- js-yaml =4.2.0 (GHSA-h67p-54hq-rp68, CVE-2026-53550, Moderate -
  quadratic-complexity DoS in merge-key handling via repeated aliases)
- form-data >=4.0.6 via override (GHSA-hmw2-7cc7-3qxx, CVE-2026-12143,
  High - CRLF injection via unescaped multipart field/file names)
- @istanbuljs/load-nyc-config > js-yaml >=3.15.0 via override
  (dev-only nested copy, same js-yaml advisory)

form-data is a transitive dependency (not in `dependencies`), so it can
only be pinned via a scoped npm override, unlike the direct deps
dompurify/js-yaml whose version lines were bumped directly.

npm audit clean for all three packages. Rebuilt dist bundles.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates swagger-ui’s dependency tree to remediate reported npm vulnerabilities by bumping direct dependency pins and adding npm overrides for transitive/dev-only vulnerable packages, with corresponding package-lock.json and dist/ regeneration updates.

Changes:

  • Bump direct dependencies: dompurify to =3.4.11 and js-yaml to =4.2.0.
  • Add npm overrides for transitive form-data and dev-only nested js-yaml under @istanbuljs/load-nyc-config.
  • Refresh package-lock.json resolutions and update dist/ license metadata + cache-busting query params in dist/index.html.

Reviewed changes

Copilot reviewed 1 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
package.json Updates direct dependency pins and adds npm overrides for transitive/dev-only vulnerable deps.
package-lock.json Reflects new resolved versions for bumped/pinned/overridden packages.
dist/swagger-ui-standalone-preset.js.LICENSE.txt Updates embedded js-yaml license/version metadata after rebuild.
dist/swagger-ui-es-bundle.js.LICENSE.txt Updates embedded dompurify and js-yaml license/version metadata after rebuild.
dist/swagger-ui-bundle.js.LICENSE.txt Updates embedded dompurify and js-yaml license/version metadata after rebuild.
dist/index.html Updates bundle cache-busting query params to match rebuilt dist/ assets.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json Outdated
"@swagger-api/apidom-reference": {
"brace-expansion": ">=5.0.6"
},
"form-data": ">=4.0.6",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this suggestion

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of adding the form-data and instanbuljs' versions, I ran "npm update form-data" and "npm update js-yaml", as per @rmb-guerra suggestion. The result in package-lock.json is the same.

…build bundles

Replace the scoped npm overrides from the previous commit with in-place
transitive updates. The patched releases are the newest in-range for
every parent, so overrides aren't needed - the floor is captured in
package-lock.json:
- remove the form-data and @istanbuljs/load-nyc-config overrides
- npm update form-data -> form-data 4.0.6
- npm update js-yaml   -> dev-only nested js-yaml 3.14.2 -> 3.15.0

Resolved versions are unchanged (form-data 4.0.6, js-yaml 4.2.0,
dompurify 3.4.11, nested dev js-yaml 3.15.0). npm audit clean for all
three; lockfile in sync; dist bundles regenerated.
@mvios
mvios merged commit 19de53f into b11 Jul 2, 2026
9 checks passed
@mvios mvios self-assigned this Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants