(ofbiz-framework) branch trunk updated: Fixed: Vulnerable dompurify in framework/rest-api flagged by Dependabot security alert

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new f7e9cec284 Fixed: Vulnerable dompurify in framework/rest-api flagged 
by Dependabot security alert
f7e9cec284 is described below

commit f7e9cec2847742135ec250642ccf7afd95d857ce
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Fri Oct 2 14:48:26 2026 +0530

    Fixed: Vulnerable dompurify in framework/rest-api flagged by Dependabot 
security alert
    
    Removed the dompurify override from framework/rest-api and updated the 
lockfile from 3.4.13 to 3.4.16, fixing a DOM XSS issue where an afterSanitize 
hook that removes nodes leaves detached subtree event handlers armed. The 
override was redundant, since redoc already declares a dompurify range that 
permits the fixed version.
---
 framework/rest-api/package-lock.json | 6 +++---
 framework/rest-api/package.json      | 3 +--
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/framework/rest-api/package-lock.json 
b/framework/rest-api/package-lock.json
index b20f3b39d8..d04275cb1a 100644
--- a/framework/rest-api/package-lock.json
+++ b/framework/rest-api/package-lock.json
@@ -326,9 +326,9 @@
             "integrity": 
"sha512-m8FnyHXV1QX+S1cl+KPFDIl6NMkxtKsy6+U/aYyjrOqWMuwAwYWu7ePqrsUHtDR5Y8Yk2pi/KIDSgF+vT4cPOQ=="
         },
         "node_modules/dompurify": {
-            "version": "3.4.13",
-            "resolved": 
"https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz";,
-            "integrity": 
"sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
+            "version": "3.4.16",
+            "resolved": 
"https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz";,
+            "integrity": 
"sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==",
             "license": "(MPL-2.0 OR Apache-2.0)",
             "optionalDependencies": {
                 "@types/trusted-types": "^2.0.7"
diff --git a/framework/rest-api/package.json b/framework/rest-api/package.json
index dffc9ce8f5..bd988c8f18 100644
--- a/framework/rest-api/package.json
+++ b/framework/rest-api/package.json
@@ -11,7 +11,6 @@
         "js-yaml": "4.3.2",
         "minimatch": "10.2.5",
         "brace-expansion": "5.0.12",
-        "fast-xml-parser": "5.10.1",
-        "dompurify": "3.4.13"
+        "fast-xml-parser": "5.10.1"
     }
 }