Skip to content

chore(deps)(deps): bump the security group across 1 directory with 2 updates - #1439

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/security-9daf7b7bfe
Open

chore(deps)(deps): bump the security group across 1 directory with 2 updates#1439
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/security-9daf7b7bfe

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the security group with 2 updates in the / directory: sanitize-html and storybook.

Updates sanitize-html from 2.18.0 to 2.18.1

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

  • Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

    This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

  • Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

    Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

Commits

Updates storybook from 10.4.2 to 10.6.2

Release notes

Sourced from storybook's releases.

v10.6.2

10.6.2

v10.6.1

10.6.1

v10.6.0

10.6.0

New skills architecture for agentic workflows

Storybook 10.6 contains hundreds of fixes and improvements:

  • 💻 CLI bindings for agent tools/skills
  • 🅰️ Angular-Vite MCP/skills support and improved docgen/snippets (experimental)
  • 🟢 Vue MCP/skills support and improved docgen/snippets (experimental)
  • 🧩 Tanstack / NextJS-Vite framework bugfixes
  • ⚡ Improved performance and reduced bundle size

... (truncated)

Changelog

Sourced from storybook's changelog.

10.6.2

10.6.1

10.6.0

New skills architecture for agentic workflows

Storybook 10.6 contains hundreds of fixes and improvements:

  • 💻 CLI bindings for agent tools/skills
  • 🅰️ Angular-Vite MCP/skills support and improved docgen/snippets (experimental)
  • 🟢 Vue MCP/skills support and improved docgen/snippets (experimental)
  • 🧩 Tanstack / NextJS-Vite framework bugfixes
  • ⚡ Improved performance and reduced bundle size

... (truncated)

Commits
  • 5f00d7d Bump version from "10.6.1" to "10.6.2" [skip ci]
  • b3ac816 Core: Cover component file name escaping in generated story imports
  • 243c06b Merge pull request #36726 from storybookjs/sidnioulz/patch-internal-v11
  • d0c7fa2 Merge pull request #36526 from storybookjs/validate/preact-11
  • b49ded6 Merge pull request #36525 from storybookjs/fix/angular-vite-analog-2-7-3
  • e067572 Merge pull request #35664 from storybookjs/bill/fix-leaky-types
  • 01331a5 Merge pull request #36419 from storybookjs/kasper/sb-2060-yarn1-proxy-remote-...
  • a17b725 Bump version from "10.6.0" to "10.6.1" [skip ci]
  • 3077af4 Merge pull request #36310 from storybookjs/fix/init-vitest-range-stderr
  • 22bf9df Merge pull request #36214 from storybookjs/ghengeveld/restore-change-detectio...
  • Additional commits viewable in compare view

Copilot AI balanced review requested due to automatic review settings October 21, 2026 23:14
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 21, 2026
Copilot AI reviewed Oct 21, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

@github-actions
github-actions Bot had a problem deploying to preview/apollo-landing October 21, 2026 23:15 Error
@github-actions github-actions Bot added the size:XXL 1,000+ changed lines. label Oct 21, 2026
@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

📊 Coverage + size by package

Per-package bundle size on this PR (no JS/TS source changes detected under packages/* or web-packages/*).

Package Coverage New-line coverage Packed (gzip) Unpacked vs main
@uipath/apollo-core — — — — —
@uipath/apollo-react — — — — —
@uipath/apollo-ui-icons — — — — —
@uipath/apollo-vertex — — — — —
@uipath/apollo-wind — — — — —
@uipath/ap-chat — — — — —

"Coverage" is each package's own coverage.include scope (e.g. apollo-core instruments only scripts/). "Packed"/"Unpacked" come from npm pack --dry-run and only cover built packages — "—" means not measured this run (package not affected / not built). "vs main" is the packed (gzipped) delta against the last successful main build (the package-sizes artifact from the Release workflow); "—" there means no main baseline was available this run. The baseline is main's latest build, not this PR's exact merge-base, so it includes any drift since the branch diverged. Packages with no vitest config are omitted.

@github-actions

github-actions Bot commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Storybook visual diff

⏭️ Skipped: the apollo-design preview deployment did not succeed, so no comparison ran. Logs

Updated (PT): Oct 26, 2026, 06:13:12 AM

@dependabot
chore(deps)(deps): bump the security group across 1 directory with 2 …
07f39f2 
…updates

Bumps the security group with 2 updates in the / directory: [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) and [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core).


Updates `sanitize-html` from 2.18.0 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

Updates `storybook` from 10.4.2 to 10.6.2
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.6.2/code/core)

---
updated-dependencies:
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  dependency-group: security
- dependency-name: storybook
  dependency-version: 10.6.2
  dependency-type: direct:development
  dependency-group: security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/security-9daf7b7bfe branch from b833b44 to 07f39f2 Compare October 26, 2026 13:11
Copilot AI balanced review requested due to automatic review settings October 26, 2026 13:11
Copilot AI reviewed Oct 26, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

@github-actions
github-actions Bot had a problem deploying to preview/apollo-landing October 26, 2026 13:11 Error

This branch was successfully deployed

No deployments
preview/apollo-docs — 07f39f20 Deployed Oct 26, 2026 by github-actions[bot]
preview/apollo-design — 07f39f20 Deployed Oct 26, 2026 by github-actions[bot]
preview/apollo-landing — 07f39f20 Deployed Oct 26, 2026 by github-actions[bot]
preview/apollo-vertex — 07f39f20 Deployed Oct 26, 2026 by github-actions[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file size:XXL 1,000+ changed lines.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant