chore(deps): clear 19 Dependabot alerts via security overrides + hey-api bump (#15166)

## Description

Fixes FE-1189

Clears **20 of the 24 open Dependabot alerts** on this repo (as of
2026-08-13, per `gh api
/repos/Comfy-Org/ComfyUI_frontend/dependabot/alerts?state=open` — the
count moves as advisories publish, so re-run that query to reconcile).
The 4 deferred alerts are astro ×3 and esbuild ×1, detailed below. Part
of the org-wide SOC2 closure (cloud repo: Comfy-Org/cloud#6387, #6460,
#6473, #6542).

**Security overrides** (extends the existing `# Security overrides`
section in `pnpm-workspace.yaml`):
- `undici@^7 → ^7.29.0` (5 alerts), `js-yaml@^4 → ^4.3.1` + `js-yaml@^3
→ ^3.15.1` (3), `fast-uri@^3 → ^3.1.5` (2), `brace-expansion` on all
five published major lines → 1.1.18 / 2.1.4 / 3.0.6 / 5.0.9 (2 open
alerts + pre-emptive coverage of the rest), `sharp@^0.34.0 → ^0.35.0`
(1) — note this deliberately violates astro 6's `optionalDependencies:
sharp ^0.34.0`; astro's exact transform sequence was verified against
0.35.3 in review, and the scoped key starts failing to match (the signal
we want) if astro ever moves its range

**Catalog / direct bumps:**
- `dompurify 3.4.7 → 3.4.13` (5 alerts) — catalog pin **plus** a
graph-wide `dompurify@^3.0.0` override so a future transitive narrowing
cannot silently reopen these; see the test-environment note below
- `@hey-api/openapi-ts 0.93.0 → 0.97.3` (2 alerts) — **pin bump only, no
regen**: the advisory's vulnerable `buildClientParams` template is not
emitted by this config's plugins, so the pin alone clears both alerts.
The earlier raw-spec regen was dropped after review — it re-added
internal endpoint literals that the BE-2669 projection strips upstream —
and the bot regen channel (#15139) will emit 0.97.3-format output from
the projected spec on its own cadence.

**Test changes — dompurify ↔ happy-dom incompatibility (FE-1189):**
dompurify ≥ 3.4.8 ("fixed the node iterator for better template
scrubbing") strips sanitized elements when running under happy-dom —
`renderMarkdownToHtml('# Title')` returns `"Title\n"` instead of
`<h1>Title</h1>`. Verified by version bisect (3.4.7 ✓ / 3.4.8+ ✗),
reproduced on happy-dom 20.9.0 and 20.11.2, and the identical probe
under **jsdom returns the correct output** — so real browsers are
unaffected; this is a test-env artifact, matching the diagnosis already
recorded in FE-1189. The upstream happy-dom issue is already filed:
capricorn86/happy-dom#2182. Since 3.4.13 is required to clear all five
dompurify advisories, the markdown-rendering test files carry a `//
@vitest-environment jsdom` pragma (plus a hoisted `ResizeObserver` stub
where needed), and `vitest.setup.ts` now carries a call-time tripwire:
any happy-dom test invoking `DOMPurify.sanitize` fails with instructions
instead of silently asserting against an inert sanitizer — it
immediately caught `ReleaseNotificationToast.test.ts` and
`WhatsNewPopup.test.ts`, which now carry the pragma too (seven files
total). If #14584 (`SanitizedHtml.vue` centralization) lands, the pragma
set should be revisited to match its component coverage.

**Deferred (4 alerts, no owner yet):**
- `astro` ×3 (`apps/website`): remediation requires `astro ≥ 7.1.0`
(CVE-2026-73422 is vulnerable through 7.0.9) — a framework major upgrade
from the pinned ^6.4.2 with its own e2e/visual suites; needs an owner,
not a pin bump
- `esbuild` ×1 (low, GHSA-g7r4-m6w7-qqqr): dev-only and confined to the
`apps/website` build chain — the root importer's vite 8.2.1 already
resolves esbuild 0.28.1 (vite accepts `^0.27.0 || ^0.28.0`), so only the
website's dev-time instance remains on 0.27.7

## How tested

- Full unit suite: **16,037 passed / 8 skipped**; the only failing file
is `scripts/cicd/check-binary-size.test.ts`, which fails identically on
clean `main` on my machine (missing local tool, exit 127) —
pre-existing, unrelated
- `pnpm typecheck` (vue-tsc) clean, including the regenerated
ingest-types consumers
- Lockfile audited instance-by-instance: every flagged package's every
instance is on a patched version
- See the review below for independent verification: base→head `pnpm
audit` drops 29→5 overall and 7→0 with `--prod`

---------

Co-authored-by: Robin Huang <robin.j.huang@gmail.com>

Author: sundar-svg

packages/ingest-types/package.json

@@ -14,6 +14,6 @@
     "zod": "catalog:"
   },
   "devDependencies": {
-    "@hey-api/openapi-ts": "0.93.0"
+    "@hey-api/openapi-ts": "0.97.3"
   }
 }

pnpm-lock.yaml

@@ -75,7 +75,7 @@ catalog:
   class-variance-authority: ^0.7.1
   cross-env: ^10.1.0
   cva: 1.0.0-beta.4
-  dompurify: 3.4.7
+  dompurify: 3.4.13
   dotenv: ^16.4.5
   eslint: ^10.8.1
   eslint-config-prettier: ^10.1.8
@@ -174,3 +174,14 @@ overrides:
   minimatch@^9.0.0: ^9.0.7
   minimatch@^10.0.0: ^10.2.3
   ajv@^8.0.0: ^8.18.0
+  undici@^7.0.0: ^7.29.0
+  dompurify@^3.0.0: ^3.4.13
+  js-yaml@^4.0.0: ^4.3.1
+  js-yaml@^3.0.0: ^3.15.1
+  fast-uri@^3.0.0: ^3.1.5
+  brace-expansion@^1.0.0: ^1.1.18
+  brace-expansion@^2.0.0: ^2.1.4
+  brace-expansion@^3.0.0: ^3.0.6
+  brace-expansion@^4.0.0: ^5.0.9
+  brace-expansion@^5.0.0: ^5.0.9
+  sharp@^0.34.0: ^0.35.0

pnpm-workspace.yaml

@@ -1,3 +1,6 @@
+// @vitest-environment jsdom
+// dompurify is inert under happy-dom — see the tripwire note in
+// vitest.setup.ts (capricorn86/happy-dom#2182, FE-1189).
 import { render, screen } from '@testing-library/vue'
 import PrimeVue from 'primevue/config'
 import { beforeEach, describe, expect, it, vi } from 'vitest'

src/components/graph/widgets/TextPreviewWidget.test.ts

@@ -1,3 +1,6 @@
+// @vitest-environment jsdom
+// dompurify is inert under happy-dom — see the tripwire note in
+// vitest.setup.ts (capricorn86/happy-dom#2182, FE-1189).
 import { createPinia } from 'pinia'
 import PrimeVue from 'primevue/config'
 import { beforeAll, describe, expect, it, vi } from 'vitest'
@@ -11,6 +14,16 @@ import * as markdownRendererUtil from '@/utils/markdownRendererUtil'
 
 import NodePreview from './NodePreview.vue'
 
+// jsdom does not implement ResizeObserver (happy-dom does); stub it before
+// component modules construct their module-level observer at import time.
+vi.hoisted(() => {
+  globalThis.ResizeObserver ??= class {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  } as unknown as typeof ResizeObserver
+})
+
 describe('NodePreview', () => {
   let i18n: ReturnType<typeof createI18n>
   let pinia: ReturnType<typeof createPinia>

src/components/node/NodePreview.test.ts

@@ -1,3 +1,6 @@
+// @vitest-environment jsdom
+// dompurify is inert under happy-dom — see the tripwire note in
+// vitest.setup.ts (capricorn86/happy-dom#2182, FE-1189).
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { nextTick, ref } from 'vue'
 

src/composables/useNodeHelpContent.test.ts

@@ -1,3 +1,6 @@
+// @vitest-environment jsdom
+// dompurify is inert under happy-dom — see the tripwire note in
+// vitest.setup.ts (capricorn86/happy-dom#2182, FE-1189).
 import { render, screen } from '@testing-library/vue'
 import userEvent from '@testing-library/user-event'
 import { beforeEach, describe, expect, it, vi } from 'vitest'

src/platform/updates/components/ReleaseNotificationToast.test.ts

@@ -1,3 +1,6 @@
+// @vitest-environment jsdom
+// dompurify is inert under happy-dom — see the tripwire note in
+// vitest.setup.ts (capricorn86/happy-dom#2182, FE-1189).
 import { render, screen } from '@testing-library/vue'
 import userEvent from '@testing-library/user-event'
 import Button from '@/components/ui/button/Button.vue'

src/platform/updates/components/WhatsNewPopup.test.ts

@@ -1,3 +1,6 @@
+// @vitest-environment jsdom
+// dompurify is inert under happy-dom — see the tripwire note in
+// vitest.setup.ts (capricorn86/happy-dom#2182, FE-1189).
 import { fromPartial } from '@total-typescript/shoehorn'
 import { render, screen } from '@testing-library/vue'
 import userEvent from '@testing-library/user-event'
@@ -22,6 +25,16 @@ const GRAPH_ID = 'graph-1'
 const NODE_ID = toNodeId('7')
 const LOCATOR = 'loc-1'
 
+// jsdom does not implement ResizeObserver (happy-dom does); stub it before
+// component modules construct their module-level observer at import time.
+vi.hoisted(() => {
+  globalThis.ResizeObserver ??= class {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  } as unknown as typeof ResizeObserver
+})
+
 const { downloadFileMock, copyMock } = vi.hoisted(() => ({
   downloadFileMock: vi.fn(),
   copyMock: vi.fn()

src/renderer/extensions/vueNodes/widgets/components/WidgetTextPreview.test.ts

@@ -1,3 +1,6 @@
+// @vitest-environment jsdom
+// dompurify is inert under happy-dom — see the tripwire note in
+// vitest.setup.ts (capricorn86/happy-dom#2182, FE-1189).
 import { describe, expect, it } from 'vitest'
 
 import { renderMarkdownToHtml } from '@/utils/markdownRendererUtil'