Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-15810938 - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-15874903 - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-15874905
Deploying windmill with
|
| Latest commit: |
2c06111
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://8b78f167.windmill.pages.dev |
| Branch Preview URL: | https://snyk-fix-7cc69a12e7e0b8f8ac5.windmill.pages.dev |
|
Claude finished @rubenfiszel's task in 57s —— View job Review: Snyk Security Fix PR
SummaryThis PR upgrades Issues FoundVersion mismatch — high risk of runtime errors All
These packages are part of the same monorepo and are designed to be used at the same version. Mixing Additionally, the Also note from the Snyk metadata: it originally intended to also upgrade RecommendationDo not merge as-is. Either:
Testing InstructionsTo verify the Monaco editor still works: open any script in the Windmill app editor (e.g., create a new Script), confirm the code editor loads correctly with syntax highlighting, autocompletion, and language features (TypeScript, Python, SQL, etc.). Also test the app builder's code editor components. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="frontend/package.json">
<violation number="1" location="frontend/package.json:89">
P1: This package is upgraded to 27.0.0 while all other `@codingame/monaco-vscode-*` siblings remain at `=25.0.0`. These packages come from the same monorepo and require version alignment — mixing major versions will almost certainly cause runtime errors (mismatched internal APIs/types).
Additionally, the exact-pin `=` prefix was dropped. Every other sibling uses `=X.Y.Z` for exact pinning; `27.0.0` without `=` is a semver range. If this upgrade is intended, all `@codingame/monaco-vscode-*` packages (and the `monaco-editor` alias) should be bumped to `=27.0.0` together.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.
| "@aws-crypto/sha256-js": "^4.0.0", | ||
| "@codingame/monaco-vscode-editor-api": "=25.0.0", | ||
| "@codingame/monaco-vscode-languages-service-override": "=25.0.0", | ||
| "@codingame/monaco-vscode-languages-service-override": "27.0.0", |
There was a problem hiding this comment.
P1: This package is upgraded to 27.0.0 while all other @codingame/monaco-vscode-* siblings remain at =25.0.0. These packages come from the same monorepo and require version alignment — mixing major versions will almost certainly cause runtime errors (mismatched internal APIs/types).
Additionally, the exact-pin = prefix was dropped. Every other sibling uses =X.Y.Z for exact pinning; 27.0.0 without = is a semver range. If this upgrade is intended, all @codingame/monaco-vscode-* packages (and the monaco-editor alias) should be bumped to =27.0.0 together.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At frontend/package.json, line 89:
<comment>This package is upgraded to 27.0.0 while all other `@codingame/monaco-vscode-*` siblings remain at `=25.0.0`. These packages come from the same monorepo and require version alignment — mixing major versions will almost certainly cause runtime errors (mismatched internal APIs/types).
Additionally, the exact-pin `=` prefix was dropped. Every other sibling uses `=X.Y.Z` for exact pinning; `27.0.0` without `=` is a semver range. If this upgrade is intended, all `@codingame/monaco-vscode-*` packages (and the `monaco-editor` alias) should be bumped to `=27.0.0` together.</comment>
<file context>
@@ -86,7 +86,7 @@
"@aws-crypto/sha256-js": "^4.0.0",
"@codingame/monaco-vscode-editor-api": "=25.0.0",
- "@codingame/monaco-vscode-languages-service-override": "=25.0.0",
+ "@codingame/monaco-vscode-languages-service-override": "27.0.0",
"@codingame/monaco-vscode-standalone-css-language-features": "=25.0.0",
"@codingame/monaco-vscode-standalone-html-language-features": "=25.0.0",
</file context>
2 participants
Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
frontend/package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-DOMPURIFY-15810938
SNYK-JS-DOMPURIFY-15874903
SNYK-JS-DOMPURIFY-15874905
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Cross-site Scripting (XSS)
🦉 Prototype Pollution
Summary by cubic
Upgrade
@codingame/monaco-vscode-languages-service-overrideto 27.0.0 infrontend/package.jsonto resolve three transitive DOMPurify vulnerabilities (XSS, prototype pollution, permissive allowlist). This reduces editor XSS risk and may include breaking changes from v27.Dependencies
@codingame/monaco-vscode-languages-service-override: 25.0.0 → 27.0.0 (fixes SNYK-JS-DOMPURIFY-15810938, SNYK-JS-DOMPURIFY-15874903, SNYK-JS-DOMPURIFY-15874905)Migration
@codingame/monaco-vscode-*packages pinned at 25.0.0, align versions to a compatible set.Written for commit 2c06111. Summary will update on new commits.