Track: DOMPurify advisories via monaco-editor's pinned dompurify@3.2.7

Long-term tracking issue for the DOMPurify Dependabot advisories (deliberately not patched now — see rationale).

Root cause

All the open dompurify alerts trace to one copy: dompurify@3.2.7, which monaco-editor pins exactly:

node_modules/monaco-editor → dompurify 3.2.7   (vulnerable)
node_modules/mermaid       → dompurify ^3.3.1 → 3.4.11 (already patched, not the concern)

Monaco uses DOMPurify internally to sanitize its markdown / hover rendering. Because monaco pins an exact version, it can't float up on its own.

Why it is not fixed now

• The proper fix is a monaco-editor release that bumps its pinned dompurify. There is no such release yet.
• Per repo policy (AGENTS.md, "Vulnerability-alert fixes — no overrides"), we do not force transitive versions with npm overrides — they mask the dependency graph and break on the parent's next update.
• One advisory (#19, IN_PLACE attacker-controlled nodeName) currently has no fix in any dompurify version, so even a bump wouldn't clear it yet.

Risk scope (why deferring is acceptable)

Monaco renders code + PR/comment metadata from the connected code platforms inside a sandboxed Electron renderer. The advisories are largely IN_PLACE / config-pollution XSS vectors that require attacker-controlled DOM objects or setConfig/clearConfig call paths the app does not expose to untrusted input — so real-world exploitability here is low. This is defense-in-depth, not a live hole. (Scoping urgency, not dismissing.)

Resolution / close condition

• Bump monaco-editor once it ships a release pinning dompurify ≥ 3.4.11, then npm ls dompurify to confirm the vulnerable 3.2.7 copy is gone.
• Close the remaining advisory (#19) once upstream DOMPurify publishes a fix and it flows through monaco.

Open alerts (as of filing)

dompurify (runtime package-lock.json): #1, #2, #3, #4, #5, #6, #7, #8, #16, #17, #18, #19, #20, #21, #22, #23.

Read the vulnerability policy in AGENTS.md and inspect the runtime package-lock.json dependency path for monaco-editor and dompurify. After monaco-editor releases a version pinning dompurify at least 3.4.11, update the dependency and run npm ls dompurify; done means the vulnerable 3.2.7 copy is gone and advisory #19 is handled upstream.