mirror of
https://github.com/astral-sh/ruff.git
synced 2026-10-28 10:45:37 +08:00
Alex Waygood
29c3a12911
The playgrounds declared Monaco 0.56.0, which pins DOMPurify 3.4.8. That version is affected by [GHSA-55q2-fjhq-7xh7](https://github.com/advisories/GHSA-55q2-fjhq-7xh7). Update Monaco to 0.57.0, which pins DOMPurify 3.4.15 and is outside the advisory's affected range. This security update is only partial: DOMPurify 3.4.15 is affected by [GHSA-p98j-92pf-mc4p](https://github.com/advisories/GHSA-p98j-92pf-mc4p) and [GHSA-6688-9rhm-gjv2](https://github.com/advisories/GHSA-6688-9rhm-gjv2), which list 3.4.16 as a patched version. It is also affected by [GHSA-c6gr-qvv4-5v3f](https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f), [GHSA-mrv2-3pqr-j5jr](https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr), and [GHSA-cg2g-xh64-v4q7](https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7), which list 3.4.17 as a patched version. Monaco 0.57.0 is the latest release and still pins DOMPurify 3.4.15. The `@monaco-editor/react` loader defaults to a CDN build of Monaco 0.52.2, which bundles DOMPurify 3.1.7. Bundle the installed Monaco package and its editor and JSON workers, so the browser uses the installed version instead of the CDN build. Codex's analysis is that Renovate's missing [support for targeted updates of transitive dependencies in `package-lock.json`](https://github.com/renovatebot/renovate/issues/46379) may explain why it did not open a security update for the vulnerable DOMPurify version. Split from #29518.
17 lines
364 B
JSON
17 lines
364 B
JSON
{
|
|
"name": "shared",
|
|
"private": true,
|
|
"version": "0.0.0",
|
|
"type": "module",
|
|
"dependencies": {
|
|
"@monaco-editor/react": "^4.7.0",
|
|
"classnames": "^2.3.2",
|
|
"fflate": "^0.8.2",
|
|
"monaco-editor": "0.57.0",
|
|
"react-aria-components": "^1.16.0",
|
|
"react": "^19.0.0",
|
|
"react-resizable-panels": "^4.0.0"
|
|
},
|
|
"exports": "./src/index.ts"
|
|
}
|