Skip to content

fix(security): override dompurify >=3.4.0, hono >=4.12.14 (GHSA-39q2-94rc-95cp, GHSA-458j-xx4x-4375)#2007

Merged
samuv merged 1 commit intomainfrom
security/auto-remediate-vulns
Apr 16, 2026
Merged

fix(security): override dompurify >=3.4.0, hono >=4.12.14 (GHSA-39q2-94rc-95cp, GHSA-458j-xx4x-4375)#2007
samuv merged 1 commit intomainfrom
security/auto-remediate-vulns

Conversation

@toolhive-studio-ci
Copy link
Copy Markdown
Contributor

Summary

Resolves two moderate-severity advisories (GHSA-39q2-94rc-95cp, GHSA-458j-xx4x-4375) by adding/bumping pnpm.overrides in package.json to force patched versions of dompurify and hono.

Changes

Advisory Package Severity Production Action Verified
GHSA-39q2-94rc-95cp dompurify@3.3.2 Moderate Yes Add override >=3.4.0 Pass
GHSA-458j-xx4x-4375 hono@4.12.12 Moderate Yes Bump existing override to >=4.12.14 Pass

Files Modified

  • package.json: Added "dompurify": ">=3.4.0" override; bumped "hono" override from >=4.12.12 to >=4.12.14

Verification

  • pnpm audit --prod: Pass
  • grype . --config .grype.yaml: Pass

@samuv samuv merged commit 208611a into main Apr 16, 2026
17 of 18 checks passed
@samuv samuv deleted the security/auto-remediate-vulns branch April 16, 2026 08:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant