ivonaest opened a new pull request, #70819: URL: https://github.com/apache/airflow/pull/70819
#Description monaco-editor pins dompurify as transitive dependency. Bumping monaco-editor to 0.56, but 0.56 added a package.json exports field that only serves .js files which made existing deep imports to CSS files (codicon stylesheets) and workers broke at build time. Fix was to rewrite all import paths and add vite workarounds. That was a lot of changes for transitive dependency. Second way of remediating these CVEs is to override dompurify directly in UI's pnpm. #Changes - airflow-core/src/airflow/ui/package.json — added pnpm.overrides "dompurify@<3.4.12": ">=3.4.12" - airflow-core/src/airflow/ui/pnpm-lock.yaml CVEs resolved: CVE-2026-0540, CVE-2026-41238, CVE-2026-41239, CVE-2026-41240, CVE-2026-49458, CVE-2026-49459, CVE-2026-49978, CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914, GHSA-c2j3-45gr-mqc4 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
