Repository navigation
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
DOMPurify update and regression coverage package.json, pnpm-workspace.yaml, tests/unit/security/dompurifySecurity.test.ts, AUDIT.md |
The DOMPurify dependency range and workspace override floor increase to 3.4.17. Four regression cases cover XHTML SVG animation targets, shadow-root sanitization, and detached subtrees. The audit records the update and test results. |
Lighthouse CI ip-address floor pnpm-workspace.yaml, tests/unit/security/ipAddressDependency.test.ts |
The override changes to >=10.7.4 <11. Tests check the locked version, the socks@2.8.7 resolution, and that @lhci/cli is a development dependency. |
Release notes and test totals CHANGELOG.md, README.md |
The changelog records both dependency updates and related checks. The README test totals change to 8,659+ across 653 files. |
Priority:
Merge Risk: 
d1db3
-
The dependency updates remediate the targeted findings without introducing a new security risk; independent CI status should still be confirmed before merging.
Comment @coderabbitai help to get the list of available commands.
Reviewer's GuideThis PR upgrades DOMPurify from 3.4.16 to 3.4.17 across direct, overridden, and jsPDF lockfile references, adds four regression cases for the fixed sanitizer boundaries, and documents the validation evidence. Reviewers should note that the overall OSV gate remains intentionally red because of the unrelated ip-address advisory; no merge should occur while that required gate fails. Sequence diagram for DOMPurify security regression validationsequenceDiagram
participant Tests as Regression tests
participant Sanitizer as DOMPurify 3.4.17
participant Gate as Security validation
Tests->>Sanitizer: sanitize special XHTML/SVG and shadow-root inputs
Sanitizer-->>Tests: sanitized output
Tests->>Sanitizer: validate hook-detached parent/sibling subtrees
Sanitizer-->>Tests: safe output
Tests->>Gate: report 4 regression cases passing
Gate-->>Tests: DOMPurify advisories cleared
Flow diagram for the remaining security gate blockerflowchart TD
Scan[OSV scan of all lockfiles] --> DOM[DOMPurify findings]
DOM -->|none after 3.4.17| Pass[DOMPurify advisory check passes]
Scan --> IP[ip-address 10.7.2]
IP -->|GHSA-rxp7-6hxx-x8q5| Blocked[Required security gate remains red]
Blocked --> NoMerge[Do not merge]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Commit ✅ Overall Status: PASSED
|
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
| Status | Commit | Started (UTC) | Finished (UTC) |
|---|---|---|---|
| ✅ Reviewed your PR | d1db37b |
Oct 30, 2026 · 08:35 | 08:41 |
| ✅ Incremental review completed | c406eb4 |
Oct 30, 2026 · 08:23 | 08:23 |
| ✅ Reviewed your PR | b954da0 |
Oct 22, 2026 · 22:27 | 22:29 |
| ✅ Reviewed your PR | a882a03 |
Oct 22, 2026 · 22:12 | 22:12 |
| ✅ Reviewed your PR | a882a03 |
Oct 22, 2026 · 22:08 | 22:12 |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
codeant-ai
Bot
added
the
size:M
|
@CodeAnt-AI review |
|
@codex review |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="pnpm-workspace.yaml" line_range="92" />
<code_context>
qs: ">=6.16.0"
fflate: ">=0.8.3"
- dompurify: ">=3.4.16" # GHSA-p98j-92pf-mc4p (fixed 3.4.16); shipped runtime dependency
+ dompurify: ">=3.4.17" # GHSA-c6gr-qvv4-5v3f / GHSA-cg2g-xh64-v4q7 / GHSA-mrv2-3pqr-j5jr; shipped runtime dependency
"@babel/core": ">=7.29.6 <8"
undici: ">=7.29.1 <8" # floor raised for GHSA-3wwx-pv8p-q78v (fixed 7.29.1); stays within 7.x (see header)
</code_context>
<issue_to_address>
**Override permits future major upgrades**
When a future DOMPurify major release is available and the lockfile is refreshed, a lockfile refresh can resolve DOMPurify 4.x because the override replaces the root dependency range with `>=3.4.17`; the lockfile importer already records that unbounded specifier despite `package.json` declaring `^3.4.17`. An incompatible major can therefore be installed outside the declared compatibility range.
Bound the override to the supported major, for example `>=3.4.17 <4`.
</issue_to_address>
### Comment 2
<location path="README.md" line_range="23" />
<code_context>
<img src="https://img.shields.io/badge/Desktop-Tauri_2-FFC131?logo=tauri&logoColor=black" alt="Tauri 2">
<img src="https://img.shields.io/badge/i18n-19_locales_%2F_2963_keys-0EA5E9" alt="19 locales — 2963 keys">
- <img src="https://img.shields.io/badge/Tests-8653%2B_%2F_651_files-22C55E" alt="8653+ tests / 651 files">
+ <img src="https://img.shields.io/badge/Tests-8655%2B_%2F_652_files-22C55E" alt="8655+ tests / 652 files">
<img src="https://img.shields.io/codecov/c/github/qnbs/WorldScript-Studio?logo=codecov&label=Coverage" alt="Codecov Coverage">
<img src="https://img.shields.io/github/actions/workflow/status/qnbs/WorldScript-Studio/.github/workflows/ci.yml?branch=main&logo=github&label=CI" alt="CI status">
</code_context>
<issue_to_address>
**Documented test total is too low**
When the README total is intended to represent Vitest's runnable test cases, `scripts/test-metrics.mjs` counts `it(` calls but misses `it.each`, so the README understates the runnable test count by two.
Update the test-metrics script to count `it.each` cases and correct the README total.
Also at `README.md:812`, `README.md:889`, `README.md:1034`, `tests/unit/security/dompurifySecurity.test.ts:42`.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and if the updated sanitizer has a regression that lets hostile markup through, it could execute when sanitized content is rendered and expose data before the issue is reverted. Reverting restores the prior version, but it cannot undo any exposure that already occurred.
Blocking findings: pnpm-workspace.yaml:92
|
|
|
Review correction at b954da0: both CodeAnt nitpicks and the matching Sourcery findings are addressed. The override is bounded to |
|
@CodeAnt-AI review |
|
@codex review |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
codeant-ai
Bot
added
size:L
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2026-10-30 — current security admission / coordinated incident #1146Latest connected GitHub checks for current head The 30 October scheduled-main OSV run https://github.com/qnbs/WorldScript-Studio/actions/runs/40997125202 scans all 3 lockfiles, exits 1, reports a now unused Next: coordinate with newly opened incident #1146. Obtain source JSON for main and PR to distinguish stale-ignore failure from remaining advisories, inspect dependency paths/compatibility, produce the smallest all-lockfile green remediation (possibly a traceable coupled successor if #1145 cannot be admitted alone). Keep DOMPurify regression tests, avoid overrides outside supported compatibility, no scanner waiver. Do not merge or claim required checks green yet; exact-head and resulting-main receipt mandatory. |
📊 CodeAnt Coverage ReportCommit: ℹ️ Status: Not applicableCoverage Metrics
New-code coverage threshold not configured; coverage is reported but not enforced. Overall coverage is informational; no total-coverage threshold is enforced. DetailsNew Code Coverage: Not applicable — no applicable code changes |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
qnbs
changed the title
|
@CodeAnt-AI review |
There was a problem hiding this comment.
Gates Passed
See analysis details in CodeScene
Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
|
Evidence update for the required all-lockfile OSV gate: a paired local diagnostic scanned exact base |
|
Correction on the unused |
2026-10-30 — direct writer handoff / do not duplicate already fixed workCurrent PR #1145 head Execute next: #1146 complete S0 dossier with actual package/OSV matrix, patchable npm cohort, Zod patch/peer paths, Core/Tauri crypto MSRV and no-fix deepmerge decision. First implement signed, source-proven compatible Commit budget / scope: PR currently 6 commits/8 files; verify base→prospective budget and active writer lease before any change. If the valid fix cannot fit as a narrow correction of #1145, use an explicitly related successor and preserve this PR's four already-proven sanitizer/ip-address regressions. Required hosted Security/CI, signatures, Rust and E2E must all pass on exact integrating head; CodeQL/CodeScene approval alone is insufficient. Blocked upstream/MSRV routes need a concise maintainer decision, not an untested override. |
User description
PR #1145 combines two narrowly scoped dependency security corrections discovered while clearing its all-lockfile OSV admission.
Changes
>=3.4.17 <4, including jsPDF's optional copy. Four focused sanitizer regressions cover the upstream XHTML/SVG, shadow-root template, and hook-detachment cases.ip-addressworkspace floor to>=10.7.4 <11for GHSA-rxp7-6hxx-x8q5. On this branch,pnpm whytraces it only through@lhci/clideveloper tooling tosocks; no first-party source reference was found. This is dependency-presence evidence, not a reproduced shipped-app exploit.Local validation on
d1db37b37ac3fc0a94983fd33c450781302afbdadocs:check, the complete localci:prepushadmission, and SSH signature verification passed.Current exact-head evidence
ip-addressadvisory is absent; the staleGHSA-hp3w-g68c-fv3cignore is still reported. The current package/advisory matrix and reachability evidence are tracked in #1146.Summary by Sourcery
Apply patched DOMPurify and ip-address dependency versions to address known security advisories while preserving compatibility and verifying the resulting dependency paths.
Bug Fixes:
Documentation:
Tests:
Summary by cubic
Updates DOMPurify to 3.4.17 and raises the dev-only
ip-addressfloor to 10.7.4, closing three DOM XSS advisories (GHSA-c6gr-qvv4-5v3f,GHSA-cg2g-xh64-v4q7,GHSA-mrv2-3pqr-j5jr) andGHSA-rxp7-6hxx-x8q5.dompurifyoverride is capped<4to keep the jsPDF 3.x contract;ip-addressis bound>=10.7.4 <11and reachable only via@lhci/cli→socks. The lockfile touches only the sanitizer,ip-address, and jsPDF's optionaldompurifycopy.ip-addressresolution.Merge blocker: the OSV scan and full CI have not run on the updated head; do not merge while the security gate is unconfirmed.
Written for commit d1db37b. Summary will update on new commits.
Summary by CodeRabbit
CodeAnt-AI Description
Patch HTML sanitizer security issues and update Lighthouse CI networking dependency
What Changed
Impact
✅ Unsafe SVG links removed during XHTML sanitization✅ Malicious content neutralized when sanitizer hooks detach nodes✅ Patched IP parsing in Lighthouse CI tooling💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.