admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security review: F34 client library upgrades approved for 8.3.0

Browse Source 
John's decision: DOMPurify to 2.5.x and Vuetify to the latest 2.x (2.6.16 as the
fallback if 2.7 does not build on Node 12.22.9), as an exception to the
front-end dependency rule, each proven by a full client build and Cypress.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-23 20:38:59 -07:00
parent 52763366c2
commit fc3342df48
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -692,7 +692,7 @@ the app ships: **DOMPurify 2.3.8**, the wiki sanitiser, has sanitiser-bypass fix
1.28.0 and `vue` 2.6.14 have only slow-regex (browser-side) advisories. Fix: raise DOMPurify to
the latest 2.5.x and Vuetify to the latest 2.7.x, both on the same major version. This is a
front-end dependency change, which CLAUDE.md rules out without John's decision; check that
both still build with Node 12.22.9.
both still build with Node 12.22.9. **John, 2026-10-23: both upgrades approved for 8.3.0**, provided they do not conflict with the Node 12.22.9 pin or break the client. Checked (read-only `npm view`): DOMPurify 2.5.9 is the latest 2.x, no engine limit, same API; Vuetify 2.7.2 (latest 2.x, peer `vue ^2.6.4`) is the target, with **2.6.16** (last 2.6, has the 2.6.10 fix) as the fallback if webpack 4 on Node 12 cannot build 2.7. Prove by a full client build, the lint, and a smoke test of wiki, calendar and date pickers, then Cypress on `devtestn10`; `package.json` and `package-lock.json` change in their own commit.
### F35 Headers, CORS, Swagger, keys in URLs (pass 9)