MartijnVisser commented on PR #29126: URL: https://github.com/apache/flink/pull/29126#issuecomment-5581999854
The override doesn't change what we ship. The dashboard copies monaco's prebuilt min/vs into assets/vs, and that bundle has DOMPurify 3.4.8 vendored inline; monaco never imports the npm dompurify package, so the 3.4.15 in node_modules ends up nowhere. That makes npm audit being clean misleading and the NOTICE now lists a version we don't bundle. Sorry, that was my suggestion. Please drop the override, list dompurify 3.4.8 (Apache-2.0) in the NOTICE, and mention in the description that the remaining findings are in monaco's vendored copy, tracked in microsoft/monaco-editor#5454. We can bump monaco once upstream releases with a newer DOMPurify. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
