Bump brace-expansion and DOMPurify out of the open advisories

[Jaggob]

Two dependency bumps, one commit each.

brace-expansion 2.1.0 → 2.1.4 and 5.0.5 → 5.0.9, lockfile only. Both copies are transitive through @nextcloud/vite-config, so they run at build time on our own globs, never on user input. Clears the two high advisories.

DOMPurify 3.4.12 → 3.4.13, which closes the IN_PLACE advisory. This one is a runtime dependency – it sanitizes the snapshot HTML in the browser before the viewer renders it – so js/ is rebuilt in the same commit: the sanitize-html chunk changes name and content, and the two entry bundles follow the new import. Nothing else in the bundles moves.

This supersedes #185, which carries the same DOMPurify bump but cannot rebuild js/ – that is why its npm build + vitest check fails against the built-assets guard in node.yml.

elliptic (low) stays open: no patched release, and it too only comes in through the build chain.

Verified: clean rm -rf node_modules && npm ci, after which npm audit reports only the remaining elliptic entries. npm run build green with js/ matching, npm test 148/148.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Bump DOMPurify to 3.4.13 and refresh built sanitize-html bundle

✨ Enhancement ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Bump DOMPurify to 3.4.13 to close the IN_PLACE advisory.
• Rebuild browser bundles so entrypoints import the new sanitize-html chunk.
• Replace sanitize-html chunk/map artifacts to match the updated dependency.

Diagram

graph TD
  A["package.json"] --> B["dompurify 3.4.13"] --> C["sanitize-html chunk"] --> D["viewer entry"]
  C --> E["embed entry"]
  subgraph Legend
    direction LR
    _cfg["Config"] ~~~ _dep["Dependency"] ~~~ _asset["Built asset"]
  end

Loading

High-Level Assessment

Updating DOMPurify and committing the regenerated build artifacts is the correct approach for projects that enforce built-assets consistency in CI. Alternatives like deferring rebuilds or patching transitive code would either fail the built-assets guard or increase maintenance risk.

Files changed (6) +9 / -4

Documentation (1) +1 / -1

sanitize-html-Bz4T9gSE.chunk.mjs.licenseUpdate generated license metadata for DOMPurify 3.4.13 +1/-1

Update generated license metadata for DOMPurify 3.4.13

• Updates the generated license header to reflect DOMPurify version 3.4.13 in the bundled artifact.

js/sanitize-html-Bz4T9gSE.chunk.mjs.license

Other (5) +8 / -3

package.jsonBump DOMPurify dependency to 3.4.13 +1/-1

Bump DOMPurify dependency to 3.4.13

• Updates the runtime dependency on DOMPurify from ^3.4.12 to ^3.4.13 to address the IN_PLACE advisory.

package.json

etherpad_nextcloud-embed-main.mjsPoint embed entry to new sanitize-html chunk +1/-1

Point embed entry to new sanitize-html chunk

• Updates the generated embed entry bundle to import the rebuilt sanitize-html chunk with the new hashed filename.

js/etherpad_nextcloud-embed-main.mjs

etherpad_nextcloud-viewer-main.mjsPoint viewer entry to new sanitize-html chunk +1/-1

Point viewer entry to new sanitize-html chunk

• Updates the generated viewer entry bundle to import the rebuilt sanitize-html chunk with the new hashed filename.

js/etherpad_nextcloud-viewer-main.mjs

sanitize-html-Bz4T9gSE.chunk.mjsAdd rebuilt sanitize-html chunk (DOMPurify 3.4.13) +4/-0

Add rebuilt sanitize-html chunk (DOMPurify 3.4.13)

• Introduces a new generated sanitize-html chunk containing DOMPurify 3.4.13 and the project’s sanitize wrapper; replaces the prior chunk via hash-based renaming.

js/sanitize-html-Bz4T9gSE.chunk.mjs

sanitize-html-Bz4T9gSE.chunk.mjs.mapAdd rebuilt source map for sanitize-html chunk +1/-0

Add rebuilt source map for sanitize-html chunk

• Adds the corresponding source map for the new sanitize-html chunk to keep debugging and built-assets integrity consistent.

js/sanitize-html-Bz4T9gSE.chunk.mjs.map

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}