From 7d9fd4b26f4d9ff86e0d5b799e7fac706695dfc5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Apr 2026 11:21:55 +0100 Subject: [PATCH 1/5] chore (deps): bump @xmldom/xmldom from 0.8.11 to 0.8.12 (#2302) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index ed4d1c8e..a614b961 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14,7 +14,7 @@ "@astronautlabs/amf": "^0.0.6", "@blu3r4y/lzma": "^2.3.3", "@wavesenterprise/crypto-gost-js": "^2.1.0-RC1", - "@xmldom/xmldom": "^0.8.11", + "@xmldom/xmldom": "^0.8.12", "argon2-browser": "^1.18.0", "arrive": "^2.5.2", "assert": "^2.1.0", @@ -4524,9 +4524,9 @@ } }, "node_modules/@xmldom/xmldom": { - "version": "0.8.11", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz", - "integrity": "sha512-cQzWCtO6C8TQiYl1ruKNn2U6Ao4o4WBBcbL61yJl84x+j5sOWWFU9X7DpND8XZG3daDppSsigMdfAIl2upQBRw==", + "version": "0.8.12", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.12.tgz", + "integrity": "sha512-9k/gHF6n/pAi/9tqr3m3aqkuiNosYTurLLUtc7xQ9sxB/wm7WPygCv8GYa6mS0fLJEHhqMC1ATYhz++U/lRHqg==", "license": "MIT", "engines": { "node": ">=10.0.0" diff --git a/package.json b/package.json index 3dbf2c8f..7a5d7f05 100644 --- a/package.json +++ b/package.json @@ -97,7 +97,7 @@ "@astronautlabs/amf": "^0.0.6", "@blu3r4y/lzma": "^2.3.3", "@wavesenterprise/crypto-gost-js": "^2.1.0-RC1", - "@xmldom/xmldom": "^0.8.11", + "@xmldom/xmldom": "^0.8.12", "argon2-browser": "^1.18.0", "arrive": "^2.5.2", "assert": "^2.1.0", From eea8bcd2500278fb91f20103a1821abd59cc5c79 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 4 Apr 2026 11:09:50 +0100 Subject: [PATCH 2/5] chore (deps): bump the patch-updates group with 2 updates (#2303) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 16 ++++++++-------- package.json | 4 ++-- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package-lock.json b/package-lock.json index a614b961..d87442a0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,7 +16,7 @@ "@wavesenterprise/crypto-gost-js": "^2.1.0-RC1", "@xmldom/xmldom": "^0.8.12", "argon2-browser": "^1.18.0", - "arrive": "^2.5.2", + "arrive": "^2.5.3", "assert": "^2.1.0", "avsc": "^5.7.9", "bcryptjs": "^2.4.3", @@ -93,7 +93,7 @@ "snackbarjs": "^1.1.0", "sortablejs": "^1.15.7", "split.js": "^1.6.5", - "sql-formatter": "^15.6.12", + "sql-formatter": "^15.7.3", "ssdeep.js": "0.0.3", "stream-browserify": "^3.0.0", "tesseract.js": "^6.0.1", @@ -5003,9 +5003,9 @@ } }, "node_modules/arrive": { - "version": "2.5.2", - "resolved": "https://registry.npmjs.org/arrive/-/arrive-2.5.2.tgz", - "integrity": "sha512-A9asXhuUR6pgHtwUciZw4FRZDR09ZwVsz1ckEGE6W9gXWrYM9cAkuKzHplpYN0bd/iobg0xqQ9fpRr/GHPsXUw==", + "version": "2.5.3", + "resolved": "https://registry.npmjs.org/arrive/-/arrive-2.5.3.tgz", + "integrity": "sha512-FsZjDDxS2BZ1TuGvqhTf8KbGaH0hOx+DS7HhYIvsreCkAuSUFgJ9NUhIC4f3SM3c5T/1he1KAn566GZjzqJarA==", "license": "MIT" }, "node_modules/asn1.js": { @@ -16633,9 +16633,9 @@ "license": "BSD-3-Clause" }, "node_modules/sql-formatter": { - "version": "15.7.2", - "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.7.2.tgz", - "integrity": "sha512-b0BGoM81KFRVSpZFwPpIPU5gng4YD8DI/taLD96NXCFRf5af3FzSE4aSwjKmxcyTmf/MfPu91j75883nRrWDBw==", + "version": "15.7.3", + "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.7.3.tgz", + "integrity": "sha512-5+zl9Nqg5aNjss0tb1G+StpC4dJKbjv3+g8CL/+V+00PfZop+2RKGyi53ScFl0dr+Dkx1LjmUO54Q3N7K3EtMw==", "license": "MIT", "dependencies": { "argparse": "^2.0.1", diff --git a/package.json b/package.json index 7a5d7f05..0774cd91 100644 --- a/package.json +++ b/package.json @@ -99,7 +99,7 @@ "@wavesenterprise/crypto-gost-js": "^2.1.0-RC1", "@xmldom/xmldom": "^0.8.12", "argon2-browser": "^1.18.0", - "arrive": "^2.5.2", + "arrive": "^2.5.3", "assert": "^2.1.0", "avsc": "^5.7.9", "bcryptjs": "^2.4.3", @@ -176,7 +176,7 @@ "snackbarjs": "^1.1.0", "sortablejs": "^1.15.7", "split.js": "^1.6.5", - "sql-formatter": "^15.6.12", + "sql-formatter": "^15.7.3", "ssdeep.js": "0.0.3", "stream-browserify": "^3.0.0", "tesseract.js": "^6.0.1", From e1352065d83b0ec8c46b326336888ddfb8894aad Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 4 Apr 2026 11:14:25 +0100 Subject: [PATCH 3/5] chore (deps): bump @codemirror/view from 6.40.0 to 6.41.0 (#2305) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index d87442a0..fe5ea29d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -117,7 +117,7 @@ "@codemirror/language": "^6.12.3", "@codemirror/search": "^6.6.0", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.40.0", + "@codemirror/view": "^6.41.0", "autoprefixer": "^10.4.27", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", @@ -1890,9 +1890,9 @@ } }, "node_modules/@codemirror/view": { - "version": "6.40.0", - "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.40.0.tgz", - "integrity": "sha512-WA0zdU7xfF10+5I3HhUUq3kqOx3KjqmtQ9lqZjfK7jtYk4G72YW9rezcSywpaUMCWOMlq+6E0pO1IWg1TNIhtg==", + "version": "6.41.0", + "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.41.0.tgz", + "integrity": "sha512-6H/qadXsVuDY219Yljhohglve8xf4B8xJkVOEWfA5uiYKiTFppjqsvsfR5iPA0RbvRBoOyTZpbLIxe9+0UR8xA==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 0774cd91..a2273fa3 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,7 @@ "@codemirror/language": "^6.12.3", "@codemirror/search": "^6.6.0", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.40.0", + "@codemirror/view": "^6.41.0", "autoprefixer": "^10.4.27", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", From 33314ac6585053cf9c4cfbf6eb0b38184ab40f5d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 4 Apr 2026 11:21:45 +0100 Subject: [PATCH 4/5] chore (deps): bump lodash from 4.17.23 to 4.18.1 (#2304) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 29 +++++++++++++++++++++++++---- package.json | 2 +- 2 files changed, 26 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index fe5ea29d..f4045c83 100644 --- a/package-lock.json +++ b/package-lock.json @@ -66,7 +66,7 @@ "kbpgp": "^2.1.17", "libbzip2-wasm": "0.0.4", "libyara-wasm": "^1.2.1", - "lodash": "^4.17.23", + "lodash": "^4.18.1", "loglevel": "^1.9.2", "loglevel-message-prefix": "^3.0.0", "lz-string": "^1.5.0", @@ -10482,6 +10482,13 @@ "url": "https://github.com/chalk/chalk?sponsor=1" } }, + "node_modules/grunt-legacy-log-utils/node_modules/lodash": { + "version": "4.17.23", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz", + "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==", + "dev": true, + "license": "MIT" + }, "node_modules/grunt-legacy-log-utils/node_modules/supports-color": { "version": "7.2.0", "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz", @@ -10505,6 +10512,13 @@ "node": ">=0.1.90" } }, + "node_modules/grunt-legacy-log/node_modules/lodash": { + "version": "4.17.23", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz", + "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==", + "dev": true, + "license": "MIT" + }, "node_modules/grunt-legacy-util": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/grunt-legacy-util/-/grunt-legacy-util-2.0.1.tgz", @@ -10524,6 +10538,13 @@ "node": ">=10" } }, + "node_modules/grunt-legacy-util/node_modules/lodash": { + "version": "4.17.23", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz", + "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==", + "dev": true, + "license": "MIT" + }, "node_modules/grunt-retro": { "version": "0.6.4", "resolved": "https://registry.npmjs.org/grunt-retro/-/grunt-retro-0.6.4.tgz", @@ -12676,9 +12697,9 @@ } }, "node_modules/lodash": { - "version": "4.17.23", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz", - "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==", + "version": "4.18.1", + "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz", + "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==", "license": "MIT" }, "node_modules/lodash.debounce": { diff --git a/package.json b/package.json index a2273fa3..7972c053 100644 --- a/package.json +++ b/package.json @@ -149,7 +149,7 @@ "kbpgp": "^2.1.17", "libbzip2-wasm": "0.0.4", "libyara-wasm": "^1.2.1", - "lodash": "^4.17.23", + "lodash": "^4.18.1", "loglevel": "^1.9.2", "loglevel-message-prefix": "^3.0.0", "lz-string": "^1.5.0", From 167cc398ce56d2d32ce3af09a311fc919644d478 Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Sat, 4 Apr 2026 12:13:05 +0100 Subject: [PATCH 5/5] Properly escape HTML entities in sampleDelim to avoid XSS issue (#2307) --- src/core/operations/OffsetChecker.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/operations/OffsetChecker.mjs b/src/core/operations/OffsetChecker.mjs index 0f66e591..2a417e4b 100644 --- a/src/core/operations/OffsetChecker.mjs +++ b/src/core/operations/OffsetChecker.mjs @@ -99,7 +99,7 @@ class OffsetChecker extends Operation { } } - return outputs.join(sampleDelim); + return outputs.join(Utils.escapeHtml(sampleDelim)); } }