Skip to content

fix: consolidate non-major Snyk security upgrades#21815

Closed
owlas wants to merge 2 commits intomainfrom
snyk/consolidate-non-major-upgrades
Closed

fix: consolidate non-major Snyk security upgrades#21815
owlas wants to merge 2 commits intomainfrom
snyk/consolidate-non-major-upgrades

Conversation

@owlas
Copy link
Copy Markdown
Collaborator

@owlas owlas commented Apr 7, 2026

Summary

  • Consolidates all non-major Snyk security upgrades into a single PR
  • handlebars 4.7.8 → 4.7.9 (common, backend) — fixes Prototype Pollution
  • dompurify 3.2.5 → 3.2.7 (frontend) — fixes mXSS vulnerability
  • jspdf 4.2.0 → 4.2.1 (frontend) — fixes ReDoS vulnerability
  • Lockfile regenerated with --config.minimum-days=1

Closes

Skipped (major upgrades)

These Snyk PRs involve major version bumps and are left open for separate review:

Test plan

  • CI passes (lint, typecheck, tests)
  • Verify lockfile resolves correctly

🤖 Generated with Claude Code

@owlas @claude
fix: consolidate non-major Snyk security upgrades
70b5456 
- handlebars 4.7.8 → 4.7.9 (common, backend)
- dompurify 3.2.5 → 3.2.7 (frontend)
- jspdf 4.2.0 → 4.2.1 (frontend)

Closes #20822
Closes #21219
Closes #21472
Closes #21496
Closes #21530

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@owlas owlas force-pushed the snyk/consolidate-non-major-upgrades branch from 687184c to 70b5456 Compare April 7, 2026 17:07
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 7, 2026 •
edited
Loading

🧪 Test Selection

✅ Tests that will run

Test Description
Preview Environment Deploys a preview environment for testing
Frontend E2E Tests Runs Cypress app tests
Backend API Tests Runs Vitest API tests
CLI Tests Runs CLI integration and dbt version tests

⏭️ Tests skipped (no relevant file changes detected)

Test How to trigger manually
Timezone Tests Add test-timezone to PR description

Tip: Add test-all to your PR description to run all tests.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 7, 2026

Your preview environment pr-21815 has been deployed with errors.

graphite-app[bot]
graphite-app Bot reviewed Apr 7, 2026
View reviewed changes
Comment thread pnpm-lock.yaml Outdated
Comment on lines +1013 to +1014
specifier: ^3.2.7
version: 3.3.1
Copy link
Copy Markdown
Contributor

@graphite-app graphite-app Bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical: dompurify downgrade detected

The lockfile shows dompurify is being downgraded from 3.3.2 to 3.3.1, not upgraded as claimed in the PR description. The PR states this fixes an mXSS vulnerability by upgrading to 3.2.7, but the actual resolved version is 3.3.1 which is older than the previous 3.3.2.

This downgrade could reintroduce security vulnerabilities that were fixed in 3.3.2.

// Expected: 3.3.2 -> 3.2.7 or newer
// Actual: 3.3.2 -> 3.3.1 (DOWNGRADE)

Fix: Update the package.json specifier to ^3.3.2 or higher to maintain the current security posture, or verify that 3.3.1 is indeed the correct target version and update the PR description accordingly.

Spotted by Graphite

Fix in Graphite

Is this helpful? React 👍 or 👎 to let us know.

@owlas @claude
fix: set dompurify to ^3.3.2 to avoid downgrade from main
f1a8623 
Main already has dompurify at 3.3.2. The previous specifier (^3.2.7)
caused the lockfile to resolve to 3.3.1, which is a downgrade.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@owlas
Copy link
Copy Markdown
Collaborator Author

owlas commented Apr 8, 2026

Fixed the dompurify downgrade issue: updated specifier to ^3.3.2 (matching current main). Lockfile now resolves to 3.3.3.

@rephus
Copy link
Copy Markdown
Collaborator

rephus commented Apr 10, 2026

Most of these have been areadly upgraded on separate PRs

@rephus rephus closed this Apr 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@graphite-app graphite-app[bot] graphite-app[bot] left review comments

Assignees

@owlas owlas

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@owlas @rephus @lightdash-bot