[Snyk] Security upgrade dompurify from 2.4.5 to 2.5.4 #6586
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Reviewer's GuideThis PR upgrades the dompurify dependency in plugins/techdocs from version 2.2.9 to 2.5.4 by modifying the version spec in package.json, fixing a high-severity prototype pollution vulnerability; reviewers should confirm dependency behavior and run yarn to update the lockfile and cache. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
⛔ Snyk checks have failed. 97 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
🔒 Entelligence AI Vulnerability Scanner ✅ No security vulnerabilities found! Your code passed our comprehensive security analysis. |
WalkthroughThis PR updates the DOMPurify dependency in the techdocs plugin from version ^2.2.9 to ^2.5.4. DOMPurify is a critical security library used for sanitizing HTML content to prevent XSS (Cross-Site Scripting) attacks. This version bump likely addresses security vulnerabilities or includes performance improvements in the HTML sanitization process. The update is a straightforward dependency version change that doesn't require any code modifications in the consuming application. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title TechDocs DOMPurify Sanitization Flow
participant User
participant Browser
participant TechDocsReader as "TechDocs Reader Component"
participant DOMPurify as "DOMPurify v2.5.4"
participant Backend as "TechDocs Backend"
User->>Browser: Navigate to documentation page
Browser->>TechDocsReader: Render documentation
TechDocsReader->>Backend: Request documentation content
Backend-->>TechDocsReader: Return HTML content
Note over TechDocsReader,DOMPurify: DOMPurify version updated from 2.2.9 to 2.5.4
TechDocsReader->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
DOMPurify-->>TechDocsReader: Return sanitized HTML
deactivate DOMPurify
TechDocsReader->>Browser: Render sanitized content
Browser-->>User: Display safe documentation
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the DOMPurify dependency in the techdocs plugin from version ^2.2.9 to ^2.5.4. DOMPurify is a critical security library used for sanitizing HTML content to prevent XSS (Cross-Site Scripting) attacks. This version bump likely addresses security vulnerabilities or includes performance improvements in the HTML sanitization process. The update is a straightforward dependency version change that doesn't require any code modifications in the consuming application. Changes
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant User
participant TechDocs as TechDocs Plugin
participant DOMPurify as DOMPurify (v2.5.4)
participant DOM as Browser DOM
User->>TechDocs: Request documentation page
activate TechDocs
TechDocs->>TechDocs: Fetch documentation content
Note over TechDocs: Raw HTML/Markdown content retrieved
TechDocs->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
Note over DOMPurify: Version upgraded from 2.2.9 to 2.5.4<br/>Enhanced sanitization capabilities
DOMPurify->>DOMPurify: Parse and clean HTML
DOMPurify-->>TechDocs: Return sanitized HTML
deactivate DOMPurify
TechDocs->>DOM: Render sanitized content
activate DOM
DOM-->>User: Display documentation
deactivate DOM
deactivate TechDocs
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant User
participant TechDocs as TechDocs Plugin
participant DOMPurify as DOMPurify (v2.5.4)
participant DOM as Browser DOM
User->>TechDocs: Request documentation page
activate TechDocs
TechDocs->>TechDocs: Fetch documentation content
Note over TechDocs: Raw HTML/Markdown content retrieved
TechDocs->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
Note over DOMPurify: Version upgraded from 2.2.9 to 2.5.4<br/>Enhanced sanitization capabilities
DOMPurify->>DOMPurify: Parse and clean HTML
DOMPurify-->>TechDocs: Return sanitized HTML
deactivate DOMPurify
TechDocs->>DOM: Render sanitized content
activate DOM
DOM-->>User: Display documentation
deactivate DOM
deactivate TechDocs
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant User
participant TechDocs as TechDocs Plugin
participant DOMPurify as DOMPurify (v2.5.4)
participant DOM as Browser DOM
User->>TechDocs: Request documentation page
activate TechDocs
TechDocs->>TechDocs: Fetch documentation content
Note over TechDocs: Raw HTML/Markdown content retrieved
TechDocs->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
Note over DOMPurify: Version upgraded from 2.2.9 to 2.5.4<br/>Enhanced sanitization capabilities
DOMPurify->>DOMPurify: Parse and clean HTML
DOMPurify-->>TechDocs: Return sanitized HTML
deactivate DOMPurify
TechDocs->>DOM: Render sanitized content
activate DOM
DOM-->>User: Display documentation
deactivate DOM
deactivate TechDocs
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant User
participant TechDocsReader as TechDocs Reader
participant DOMPurify as DOMPurify (v2.5.4)
participant ContentSource as Content Source
participant DOM as Browser DOM
User->>TechDocsReader: Request documentation page
TechDocsReader->>ContentSource: Fetch documentation content
ContentSource-->>TechDocsReader: Return raw HTML/Markdown content
Note over TechDocsReader,DOMPurify: Upgraded from v2.2.9 to v2.5.4
TechDocsReader->>DOMPurify: sanitize(rawContent)
activate DOMPurify
Note over DOMPurify: Remove potentially harmful<br/>HTML elements and attributes
DOMPurify-->>TechDocsReader: Return sanitized HTML
deactivate DOMPurify
TechDocsReader->>DOM: Render sanitized content
DOM-->>User: Display documentation page
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
EntelligenceAI PR Summary
Updates the dompurify dependency in the techdocs plugin to address security vulnerabilities and bug fixes.