From 943e2a83ea390948cb485a3019dc5e6740ac8689 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Sat, 8 Aug 2026 08:40:30 +0000 Subject: [PATCH 1/2] chore: upgrade dompurify to ^3.4.13 to address GHSA-55q2-fjhq-7xh7 Co-Authored-By: Claude Opus 5 (1M context) --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 8c17cdd19..ddea013b9 100644 --- a/yarn.lock +++ b/yarn.lock @@ -13451,14 +13451,14 @@ __metadata: linkType: hard "dompurify@npm:^3.3.2, dompurify@npm:^3.3.3": - version: 3.4.12 - resolution: "dompurify@npm:3.4.12" + version: 3.4.13 + resolution: "dompurify@npm:3.4.13" dependencies: "@types/trusted-types": "npm:^2.0.7" dependenciesMeta: "@types/trusted-types": optional: true - checksum: 10c0/127a13817353d4e20e75a991a9022a04c3af12af7479f68e2b8bee6dbc7330a96edfb8f4ebff96f4f0f24cd43e8dbba46214131f510c3aa87a843bd8b610d0ab + checksum: 10c0/9c2a1a71e1a1d8b77953db7a39ffc935ef4ed4f10fe40770232128c2cbfd4c3dc677d3d7bae51eb24cc52d9ff3548612dc540ecb4343e89b26e809d2be2e0cfe languageName: node linkType: hard From e002872f19ceb1f1b4fa50c0f023cb07b9f31e0a Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Sat, 8 Aug 2026 08:40:49 +0000 Subject: [PATCH 2/2] chore: add CHANGELOG entry for dompurify upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a3335d4cd..542661227 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,6 +28,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - [EE] Fixed Ask MCP connector tools failing to load when their input schemas use JSON Schema 2019-09 or 2020-12. [#1547](https://github.com/sourcebot-dev/sourcebot/pull/1547) - Upgraded `js-yaml` to `^4.3.1`. [#1552](https://github.com/sourcebot-dev/sourcebot/pull/1552) - Upgraded `reo-census` to `^1.2.10` in `setup-sourcebot`. [#1554](https://github.com/sourcebot-dev/sourcebot/pull/1554) +- Upgraded `dompurify` to `^3.4.13`. [#1556](https://github.com/sourcebot-dev/sourcebot/pull/1556) ## [5.1.5] - 2026-07-31