Repository navigation
deps(security): bump dompurify, ip-address, next 16.4.2 and the plugin's toml (clears the critical npm audit on the base) - #18067
Merged
diegosouzapw merged 2 commits intoOct 25, 2026
Conversation
…e plugin's toml to 5.0.1 Dependabot alerts on runtime dependencies of the root lockfile: - dompurify 3.4.16 (#330 low, #331 high, #332 critical; first patched 3.4.17). The direct range and the monaco-editor override move from ^3.4.14 to ^3.4.17. - ip-address 10.7.2 (#329 medium; first patched 10.7.4). The override moves from ^10.7.2 to ^10.7.4. And in @omniroute/opencode-plugin (development only): - toml 4.3.0 (#325, #326 high, quadratic toml.parse; first patched 5.0.1). The plugin's override moves from ^4.1.2 to ^5.0.1. toml only reaches the plugin through effect (a dev dependency of @opencode-ai/plugin), which calls Toml.parse(); that API is unchanged in 5.x. Lockfile-only regeneration. Root: dompurify 3.4.16 -> 3.4.17, ip-address 10.7.2 -> 10.7.4. Plugin: toml 4.3.0 -> 5.0.1. Nothing else moves.
Dependabot alerts #327 (high), #328 and #333 (critical) flag next >= 16.0.0, <= 16.4.0. Same version and lockfile delta as the Dependabot PR #17969 (next + @next/env + the @next/swc-* binaries 16.3.8 -> 16.4.2), whose Build, E2E 1-9/9, Electron package smoke and Ecosystem jobs passed with it. Landing it next to the dompurify bump clears all three critical npm audit findings on the base (dompurify, monaco-editor via dompurify, next), which the Lint job's `npm audit --audit-level=critical` blocks on; on separate PRs each one still carries the other's critical finding.
diegosouzapw
changed the title
Contributor
CI Coverage Report
Coverage artifact was not available for this run. |
This was referenced Oct 25, 2026
diegosouzapw
added a commit
that referenced
this pull request
Oct 26, 2026
The security bump to next 16.4.2 (#18067) left eslint-config-next and its @next/eslint-plugin-next on 16.3.8. Pin them to 16.4.2, the same release as next. Lockfile-only change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
dompurify^3.4.14→^3.4.17(dependency +monaco-editoroverride)ip-address^10.7.2→^10.7.4toml@omniroute/opencode-plugin, dev only^4.1.2→^5.0.1next16.3.8→16.4.2Why
Lintjob runsnpm audit --audit-level=critical, and the base carries three critical findings (dompurify, monaco-editor via dompurify, next). Split across two PRs, each one still failsLinton the other's finding. Together they clearLintand bringvuln-ratchet(29 > baseline 27 on the base) back under the ceiling. deps: bump next from 16.3.8 to 16.4.2 #17969 becomes redundant.toml5.x major was approved by the maintainer. It reaches the plugin only througheffect, a dev dependency of@opencode-ai/plugin, which only callsToml.parse(); that API is unchanged in 5.x.Lockfile delta (complete)
package-lock.json:dompurify3.4.16 → 3.4.17,ip-address10.7.2 → 10.7.4,next+@next/env+ 9@next/swc-*16.3.8 → 16.4.2@omniroute/opencode-plugin/package-lock.json:toml4.3.0 → 5.0.1Nothing else moves. Both lockfiles were regenerated with
npm install --package-lock-only --ignore-scripts.Validation
npm ci:npm run buildOK;npm test388/388.Toml.parse()from toml 5.0.1 parses tables and values as before.opencode-free-removal-keyed-preservation-16310andbuild/free-catalog-evidencefail identically on the base code with next 16.3.8, so they are not caused by this bump. The same two show up on deps: bump next from 16.3.8 to 16.4.2 #17969 and on the test-only test(security): escape every regex metacharacter in the icon-map identifier match (CodeQL #1166, #1167) #18057.node_moduleswith the main checkout. The CI unit/vitest/build jobs are the proof for the root.