npm audit --omit=dev on the current v2.6.14 lockfile reports direct production vulnerabilities in DOMPurify and Mermaid. Markpad renders untrusted Markdown/HTML in a desktop webview, so these need a focused dependency update.
Scope:
- DOMPurify: 3.3.1 → a patched 3.4.x release.
- Mermaid: 11.12.2 → a patched 11.x release, including the transitive parser/lodash advisories.
The PR must retain the existing sanitizer and Mermaid rendering behavior, run the complete test/build suite, and re-run the production audit.
npm audit --omit=devon the current v2.6.14 lockfile reports direct production vulnerabilities in DOMPurify and Mermaid. Markpad renders untrusted Markdown/HTML in a desktop webview, so these need a focused dependency update.Scope:
The PR must retain the existing sanitizer and Mermaid rendering behavior, run the complete test/build suite, and re-run the production audit.