[Snyk] Security upgrade dompurify from 2.4.5 to 2.5.4 #2575
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
No applications have been configured for previews targeting branch: master. To do so go to restack console and configure your applications for previews. |
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
⛔ Snyk checks have failed. 97 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
🔒 Entelligence AI Vulnerability Scanner ✅ No security vulnerabilities found! Your code passed our comprehensive security analysis. |
WalkthroughThis PR updates the DOMPurify dependency in the Google Calendar plugin from version 2.3.6 to version 2.5.4. DOMPurify is a critical security library used for sanitizing HTML content to prevent Cross-Site Scripting (XSS) attacks. This targeted update addresses potential security vulnerabilities while maintaining all other dependencies at their current versions, enhancing the overall security posture of the gcalendar plugin without introducing broader dependency changes. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title GCalendar Plugin DOMPurify Usage Flow
participant User
participant GCalendar as "GCalendar Plugin"
participant DOMPurify as "DOMPurify v2.5.4"
participant DOM as "DOM"
User->>GCalendar: Interact with calendar
Note over GCalendar: Plugin receives potentially<br/>unsafe HTML content
GCalendar->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
DOMPurify-->>GCalendar: Return sanitized HTML
deactivate DOMPurify
GCalendar->>DOM: Render sanitized content
DOM-->>User: Display safe content
Note over GCalendar,DOMPurify: Version updated from 2.3.6 to 2.5.4<br/>for security improvements
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the DOMPurify dependency in the Google Calendar plugin from version 2.3.6 to version 2.5.4. DOMPurify is a critical security library used for sanitizing HTML content to prevent Cross-Site Scripting (XSS) attacks. This targeted update addresses potential security vulnerabilities while maintaining all other dependencies at their current versions, enhancing the overall security posture of the gcalendar plugin without introducing broader dependency changes. Changes
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant App as GCalendar Plugin
participant DOMPurify as DOMPurify Library (v2.5.4)
participant HTML as HTML Content
Note over App,DOMPurify: Dependency version updated from 2.3.6 to 2.5.4
App->>HTML: Receive HTML content from calendar data
App->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
DOMPurify->>DOMPurify: Parse and clean HTML
DOMPurify-->>App: Return sanitized HTML
deactivate DOMPurify
App->>App: Render safe HTML content
Note over App,DOMPurify: No architectural changes<br/>Same interaction pattern with updated library version
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant App as GCalendar Plugin
participant DP as DOMPurify Library
Note over App,DP: Dependency Version Update: 2.3.6 → 2.5.4
Note over App,DP: No changes to component interactions
App->>DP: sanitize(htmlContent)
activate DP
DP-->>App: sanitizedHTML
deactivate DP
Note over App,DP: Usage pattern remains unchanged<br/>Only library version updated
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant App as GCalendar Plugin
participant DOMPurify as DOMPurify Library (v2.5.4)
participant HTML as HTML Content
Note over App,DOMPurify: Dependency version updated from 2.3.6 to 2.5.4
App->>HTML: Receive HTML content from calendar data
App->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
DOMPurify->>DOMPurify: Parse and clean HTML
DOMPurify-->>App: Return sanitized HTML
deactivate DOMPurify
App->>App: Render safe HTML content
Note over App,DOMPurify: No architectural changes<br/>Same interaction pattern with updated library version
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the DOMPurify dependency in the gcalendar plugin from version 2.3.6 to 2.5.4. DOMPurify is an HTML sanitization library that helps prevent XSS attacks by cleaning potentially malicious content. This minor version bump brings the plugin up to date with recent bug fixes and security patches while maintaining backward compatibility within the 2.x version range through the caret (^) versioning prefix. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant User
participant GCalendarPlugin
participant DOMPurify
participant DOM
User->>GCalendarPlugin: Request calendar event data
GCalendarPlugin->>GCalendarPlugin: Fetch event with HTML content
Note over GCalendarPlugin: Event may contain<br/>HTML descriptions
GCalendarPlugin->>DOMPurify: sanitize(htmlContent)
Note over DOMPurify: Version upgraded<br/>2.3.6 → 2.5.4
DOMPurify->>DOMPurify: Parse and clean HTML
DOMPurify-->>GCalendarPlugin: Return sanitized HTML
GCalendarPlugin->>DOM: Render sanitized content
DOM-->>User: Display safe calendar event
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
EntelligenceAI PR Summary
Updates the DOMPurify dependency in the gcalendar plugin to incorporate recent security patches and bug fixes.
dompurifyfrom ^2.3.6 to ^2.5.4 inplugins/gcalendar/package.json