chore(deps): sanitize-html 2.18.1, i18next-http-backend 4.0.3 [security] #465

2026-10-25T11:55:43-04:00

jared commented

2026-10-25 11:55:43 -04:00

Matches upstream Cinny 4.12.8, which is a security release that bumps these two dependencies.

Package	Was	Now
sanitize-html	2.17.7	2.18.1
i18next-http-backend	4.0.2	4.0.3

Why it matters here: npm audit flagged our sanitize-html 2.17.7 with three advisories, two of them XSS bypasses. sanitize-html cleans the HTML of every formatted message, so this is on a hot path:

SMIL animation namespace-prefix bypass allowing javascript: URIs;
meta http-equiv=refresh still allowing javascript: / data: URLs (incomplete fix of CVE-2026-53606);
<noscript> content rendering after an implied close.

After the bump, npm audit --omit=dev reports 0 production advisories.

Tested

tsc is clean.
Unit tests: 1,440 pass, including the sanitizer tests.
Build succeeds.
Playwright: boot, send/receive, and the forwarded-message header, 3/3.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

Matches upstream **Cinny 4.12.8**, which is a security release that bumps these two dependencies. | Package | Was | Now | |---|---|---| | sanitize-html | 2.17.7 | **2.18.1** | | i18next-http-backend | 4.0.2 | **4.0.3** | **Why it matters here:** `npm audit` flagged our `sanitize-html` 2.17.7 with three advisories, two of them XSS bypasses. `sanitize-html` cleans the HTML of every formatted message, so this is on a hot path: - SMIL animation namespace-prefix bypass allowing `javascript:` URIs; - `meta http-equiv=refresh` still allowing `javascript:` / `data:` URLs (incomplete fix of CVE-2026-53606); - `<noscript>` content rendering after an implied close. After the bump, `npm audit --omit=dev` reports **0 production advisories**. **Tested** - tsc is clean. - Unit tests: 1,440 pass, including the sanitizer tests. - Build succeeds. - Playwright: boot, send/receive, and the forwarded-message header, 3/3. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-25 11:55:44 -04:00

chore(deps): sanitize-html 2.18.1, i18next-http-backend 4.0.3 [security]

CI / Build & Quality Checks (push) Skipped

CI / Secret scan (gitleaks) (push) Skipped

CI / Playwright smoke (e2e) (push) Skipped

CI / Build & Quality Checks (pull_request) Successful in 4m36s

Details

CI / Trigger Desktop Build (pull_request) Skipped

Details

CI / Docker image build & smoke test (pull_request) Skipped

Details

CI / Secret scan (gitleaks) (pull_request) Successful in 16s

Details

CI / Playwright smoke (e2e) (pull_request) Successful in 18m10s

Details

a7495fc509

Matches upstream Cinny 4.12.8. npm audit flagged our sanitize-html
2.17.7 with three advisories, two of them XSS bypasses (SMIL animation
namespace-prefix javascript: URIs; meta refresh javascript:/data: URLs;
noscript content rendering after an implied close). sanitize-html cleans
formatted message HTML. After the bump: 0 production advisories.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared scheduled this pull request to auto merge when all checks succeed 2026-10-25 11:55:54 -04:00

jared merged commit 826fc46229 into lotus

2026-10-25 12:18:51 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/cinny#465