OCPBUGS-99040: Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7

[germanparente]

Description of the Change

CVE-2026-49978: DOMPurify IN_PLACE sanitization bypass via attached Shadow Root inside <template>.content (XSS). Affects DOMPurify versions <= 3.4.6.

Console has DOMPurify 3.4.3 as a transitive dependency via monaco-editor. This adds a dompurify yarn resolution to bump it to ^3.4.11 (resolved to 3.4.12).

Jira

OCPBUGS-99040

Screenshots / Screen Recordings

N/A - dependency version bump only, no UI changes.

Testing

• Verified yarn.lock resolves dompurify to 3.4.12 (above fix version 3.4.7).

Summary by CodeRabbit

• Bug Fixes
  • Updated the content sanitization dependency to dompurify 3.4.x (via a pinned resolution) to improve security and reliability.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@germanparente: This pull request references Jira Issue OCPBUGS-99040, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Description of the Change

CVE-2026-49978: DOMPurify IN_PLACE sanitization bypass via attached Shadow Root inside <template>.content (XSS). Affects DOMPurify versions <= 3.4.6.

Console has DOMPurify 3.4.3 as a transitive dependency via monaco-editor. This adds a dompurify yarn resolution to bump it to ^3.4.11 (resolved to 3.4.12).

Jira

OCPBUGS-99040

Screenshots / Screen Recordings

N/A - dependency version bump only, no UI changes.

Testing

• Verified yarn.lock resolves dompurify to 3.4.12 (above fix version 3.4.7).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d1f8b50d-2dfc-4937-a42c-d6cbd5c95e3f

📥 Commits

Reviewing files that changed from the base of the PR and between 6cadf38 and 0cb730a.

⛔ Files ignored due to path filters (1)

• frontend/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• frontend/package.json

---

Walkthrough

The frontend package resolutions add dompurify at ^3.4.11; the existing protobufjs resolution remains 7.6.5.

Changes

Dependency Resolution

Layer / File(s)	Summary
DOMPurify resolution update frontend/package.json	Adds the dompurify resolution at ^3.4.11 while retaining protobufjs at 7.6.5.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• openshift/console#16813: Updates the same frontend/package.json resolutions block, including protobufjs.

Suggested reviewers: jhadvig, therealjon, rhamilto

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the change, Jira, screenshots, and testing, but omits required root cause, solution details, test setup, test cases, and browser conformance.	Add the missing template sections: Analysis/Root cause, Solution description, Test setup, Test cases, Browser conformance, Additional info, and Reviewers/assignees.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the PR's security-focused DOMPurify resolution bump.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only frontend/package.json and frontend/yarn.lock changed; no Ginkgo test titles or test files were modified.
Test Structure And Quality	✅ Passed	This PR only bumps DOMPurify in package.json/yarn.lock; no Ginkgo tests or cluster-interaction code changed.
Microshift Test Compatibility	✅ Passed	Only frontend/package.json and yarn.lock changed; no Ginkgo e2e tests were added or modified, so MicroShift compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests were added or modified; this PR only updates frontend dependency resolution files.
Topology-Aware Scheduling Compatibility	✅ Passed	Diff only updates frontend/package.json and yarn.lock to pin dompurify; no manifests, controllers, or scheduling code changed.
Ote Binary Stdout Contract	✅ Passed	PR only bumps dompurify via package.json/yarn.lock; no process-level code or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo/e2e tests were added or modified; this PR only bumps the DOMPurify resolution in frontend/package.json and yarn.lock.
No-Weak-Crypto	✅ Passed	HEAD only changes frontend/package.json to add a dompurify resolution; no flagged weak-crypto, custom crypto, or secret-comparison code was introduced.
Container-Privileges	✅ Passed	PR only changes frontend/package.json and frontend/yarn.lock for dompurify; no container/K8s manifests or privilege settings appear in the changed files.
No-Sensitive-Data-In-Logs	✅ Passed	Only dependency-resolution and lockfile changes were made; no application code or logging statements were added or modified.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: germanparente
Once this PR has been reviewed and has the lgtm label, please assign jhadvig for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• frontend/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@germanparente: This pull request references Jira Issue OCPBUGS-99040, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Description of the Change

CVE-2026-49978: DOMPurify IN_PLACE sanitization bypass via attached Shadow Root inside <template>.content (XSS). Affects DOMPurify versions <= 3.4.6.

Console has DOMPurify 3.4.3 as a transitive dependency via monaco-editor. This adds a dompurify yarn resolution to bump it to ^3.4.11 (resolved to 3.4.12).

Jira

OCPBUGS-99040

Screenshots / Screen Recordings

N/A - dependency version bump only, no UI changes.

Testing

• Verified yarn.lock resolves dompurify to 3.4.12 (above fix version 3.4.7).

Summary by CodeRabbit

• Bug Fixes
• Updated the content sanitization component to version 3.4.11 for improved security and reliability.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@frontend/package.json`:
- Line 228: Update the dompurify dependency declaration in package.json from the
caret range to the exact fixed release 3.4.12, preventing future 3.x updates
when the lockfile is refreshed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ba847423-35cc-463d-a67f-b8b68116408e

📥 Commits

Reviewing files that changed from the base of the PR and between 38882a3 and 114b425.

⛔ Files ignored due to path filters (1)

• frontend/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• frontend/package.json

[openshift-ci]

@germanparente: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	6cadf38	link	true	/test images
ci/prow/e2e-gcp-console-techpreview	6cadf38	link	false	/test e2e-gcp-console-techpreview
ci/prow/okd-scos-images	6cadf38	link	true	/test okd-scos-images
ci/prow/analyze	6cadf38	link	true	/test analyze
ci/prow/frontend	6cadf38	link	true	/test frontend
ci/prow/backend	6cadf38	link	true	/test backend
ci/prow/e2e-playwright-techpreview	6cadf38	link	false	/test e2e-playwright-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.