Security bumps for the vendored libraries (dompurify, chartjs-chart-venn) - #18
Merged
Merged
Conversation
The offline note points a reader at `z2ui5_cl_exit` for where to repoint `cs_config-src`. That class is gone with the core-layer rename; the default it describes (`cs_config-src = https://sdk.openui5.org/...`) sits in z2ui5_cl_ui5_user_exit today. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TcX8VpcUFd9tjz1bE2HNdx
Lockfile only. The vendored runtime libraries (chart.js, marked, dompurify, …) are exact-pinned on purpose - build:local bakes them into the offline branch - so none of them moved. Verified: abaplint 70 files, 27 unit tests pass.
Both are vendored into the offline branch and shipped to customer systems, so
they are exact-pinned on purpose - the pin is for reproducibility, not for
never updating, and these two carried every advisory the repo had:
before 5 vulnerabilities (1 moderate, 4 high)
@upsetjs/venn.js, chartjs-chart-venn, dompurify, fmin, rollup
after 0
dompurify is the sanitizer behind the Markdown control, so a moderate advisory
there is the shipped control's problem, not just the build's. Both fixes are
within the same major.
The venn bump also drops 158 transitive packages - 4.2.7 pulled fmin,
@upsetjs/venn.js, rollup and a tape-style test harness into the install tree
(186 lockfile entries, now 29).
Followed the documented procedure from tools/vendor.mjs ("bumping a version is
a change to package.json plus a re-run of this script"): LibUrls.js is
regenerated, so the CDN URL and the vendored file still name the same version.
Verified: 27 unit tests pass, abaplint 70 files clean, and npm run build:local
vendors the new purify.js / chartjs_chart_venn.js into the offline artefact.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dompurify 3.1.6 → 3.4.13, chartjs-chart-venn 4.2.7 → 4.3.7
Both are vendored into the offline branch and shipped to customer systems, so they are exact-pinned on purpose — the pin is for reproducibility, not for never updating, and these two carried every advisory the repo had:
dompurifyis the sanitizer behind the Markdown control, so a moderate advisory there is the shipped control's problem, not just the build's. Both fixes are within the same major.The venn bump also drops 158 transitive packages — 4.2.7 pulled
fmin,@upsetjs/venn.js,rollupand a tape-style test harness into the install tree (186 lockfile entries, now 29).Followed the documented procedure from
tools/vendor.mjs("bumping a version is a change to package.json plus a re-run of this script"):LibUrls.jsis regenerated, so the CDN URL and the vendored file still name the same version.Stale framework class name
The README still referenced a pre-rename framework class; followed through.
Verification
npx abaplint— 70 files, 0 issuesnpm run build:localvendors the newpurify.js/chartjs_chart_venn.jsinto the offline artefactThe remaining out-of-date libraries (
marked12 → 18,driver.js1.3 → 1.8,bwip-js, the other chart plugins) are majors that ship to customer systems with no security pressure behind them — left for a deliberate decision rather than bundled in here.Branch is up to date with
mainand merges cleanly.Generated by Claude Code