[Snyk] Security upgrade dompurify from 2.4.5 to 2.5.4 #6494
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
Reviewer's GuideThis PR updates the dompurify dependency in the microsoft-calendar plugin from v2.3.6 to v2.5.4 to resolve a high-severity prototype pollution vulnerability and notes the need to regenerate the yarn.lock before merging. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
🔒 Entelligence AI Vulnerability Scanner ✅ No security vulnerabilities found! Your code passed our comprehensive security analysis. |
WalkthroughThis PR updates the DOMPurify dependency in the Microsoft Calendar plugin from version 2.3.6 to 2.5.4. DOMPurify is a critical security library used for sanitizing HTML content to prevent Cross-Site Scripting (XSS) attacks. The update ensures the plugin incorporates the latest security patches and improvements available in the newer version, enhancing the overall security posture of the Microsoft Calendar plugin. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title Microsoft Calendar Plugin with DOMPurify Integration
actor User
participant UI as "Calendar UI"
participant Plugin as "Microsoft Calendar Plugin"
participant GraphAPI as "Microsoft Graph API"
participant DOMPurify as "DOMPurify v2.5.4"
User->>UI: View calendar events
activate UI
UI->>Plugin: fetchEvents()
activate Plugin
Plugin->>GraphAPI: Request calendar events
activate GraphAPI
GraphAPI-->>Plugin: Return events with HTML content
deactivate GraphAPI
Note over Plugin,DOMPurify: Security update: DOMPurify 2.3.6 → 2.5.4
loop For each event with HTML content
Plugin->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
DOMPurify-->>Plugin: Return sanitized HTML
deactivate DOMPurify
end
Plugin-->>UI: Return sanitized events
deactivate Plugin
UI-->>User: Display safe calendar events
deactivate UI
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
⛔ Snyk checks have failed. 97 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the DOMPurify dependency in the Microsoft Calendar plugin from version 2.3.6 to 2.5.4. DOMPurify is a critical security library used for sanitizing HTML content to prevent Cross-Site Scripting (XSS) attacks. The update ensures the plugin incorporates the latest security patches and improvements available in the newer version, enhancing the overall security posture of the Microsoft Calendar plugin. Changes
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Dev as Developer
participant Package as package.json
participant NPM as NPM Registry
participant App as Microsoft Calendar Plugin
Note over Dev,App: Dependency Version Update (dompurify 2.3.6 → 2.5.4)
Dev->>Package: Update dompurify version to ^2.5.4
Dev->>NPM: npm install
NPM->>NPM: Resolve dependencies
NPM-->>App: Install dompurify@2.5.4
Note over App: Plugin continues to use DOMPurify<br/>for HTML sanitization with updated version
App->>App: Runtime: Sanitize calendar content<br/>using updated DOMPurify library
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Dev as Developer
participant Package as package.json
participant NPM as NPM Registry
participant App as Microsoft Calendar Plugin
Note over Dev,App: Dependency Version Update (dompurify 2.3.6 → 2.5.4)
Dev->>Package: Update dompurify version to ^2.5.4
Dev->>NPM: npm install
NPM->>NPM: Resolve dependencies
NPM-->>App: Install dompurify@2.5.4
Note over App: Plugin continues to use DOMPurify<br/>for HTML sanitization with updated version
App->>App: Runtime: Sanitize calendar content<br/>using updated DOMPurify library
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Dev as Developer
participant Package as package.json
participant NPM as NPM Registry
participant App as Microsoft Calendar Plugin
Note over Dev,App: Dependency Version Update (dompurify 2.3.6 → 2.5.4)
Dev->>Package: Update dompurify version to ^2.5.4
Dev->>NPM: npm install
NPM->>NPM: Resolve dependencies
NPM-->>App: Install dompurify@2.5.4
Note over App: Plugin continues to use DOMPurify<br/>for HTML sanitization with updated version
App->>App: Runtime: Sanitize calendar content<br/>using updated DOMPurify library
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant User
participant CalendarUI as Calendar UI Component
participant DOMPurify as DOMPurify (v2.5.4)
participant DOM as Browser DOM
User->>CalendarUI: View calendar event with HTML content
activate CalendarUI
Note over CalendarUI,DOMPurify: Dependency upgraded from v2.3.6 to v2.5.4
CalendarUI->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
DOMPurify-->>CalendarUI: sanitizedHTML
deactivate DOMPurify
CalendarUI->>DOM: Render sanitized content
DOM-->>User: Display safe HTML
deactivate CalendarUI
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant User
participant CalendarUI as Calendar UI
participant DOMPurify as DOMPurify (v2.5.4)
participant DOM
User->>CalendarUI: View calendar event with HTML content
CalendarUI->>DOMPurify: sanitize(htmlContent)
Note over DOMPurify: Upgraded from v2.3.6 to v2.5.4
DOMPurify->>DOMPurify: Parse and clean HTML
DOMPurify-->>CalendarUI: Return sanitized HTML
CalendarUI->>DOM: Render safe HTML content
DOM-->>User: Display calendar event
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
EntelligenceAI PR Summary
Updates the dompurify dependency in the microsoft-calendar plugin to incorporate bug fixes and security patches.