[mnaimfaizy]

Cause

After #237 merged to main as 11c7e95, Secure Install Review failed again on npm audit --audit-level=high. The new finding is critical, and it is not Vite.

monaco-editor@0.57.0 depends on dompurify@3.4.15. An override already forces dompurify@3.4.16 so the tree does not install 3.4.15. Advisories published on 2026-10-22 put every release through 3.4.16 in range, including that override:

Advisory	Severity	Range	Patched
GHSA-cg2g-xh64-v4q7 SAFE_FOR_TEMPLATES bypass via shadow roots	critical	>= 3.4.4, <= 3.4.16	3.4.17
GHSA-mrv2-3pqr-j5jr IN_PLACE leaves event handlers armed	high	<= 3.4.16	3.4.17
GHSA-c6gr-qvv4-5v3f SMIL attributeName=href skipped in XHTML mode	low	<= 3.4.16	3.4.17

npm audit reports this as critical on dompurify <= 3.4.16, reached through monaco-editor >= 0.56.0-dev-20260113. Its only suggested fix is npm audit fix --force, which installs monaco-editor@0.55.1. That is a downgrade from 0.57.0. There is no Monaco release newer than 0.57.0. The audit threshold is unchanged.

Fix

Move the existing override from dompurify@3.4.16 to dompurify@3.4.17.

3.4.17 (2026-10-12) is the first patched release and the newest release, and it is at least 7 days old. The published package has no install lifecycle script (prepare is husky, which npm does not run for a registry dependency). No new node_modules entries. The lockfile only changes the dompurify version, tarball URL, and integrity. The URL stays on https://registry.npmjs.org/.

npm audit --audit-level=high exits 0. Three moderate Vitest findings (GHSA-p458-7748-mcp3) remain and are below that gate. They are already in the open development group PR.

What this does not change

Monaco 0.57.0 also vendors DOMPurify 3.4.15 at esm/vs/base/browser/dompurify/dompurify.js and imports that file, not the npm package. The override replaces the package npm audits. It does not rewrite Monaco's vendored copy. No newer Monaco release vendors 3.4.17, and downgrading Monaco to 0.55.1 is the breaking change this PR avoids.

Justification

DOMPurify is already in the tree because Monaco declares it. The override is the patched release of that package, not a new dependency.

Local verification

npm ci --ignore-scripts left package-lock.json unchanged. npx tsc -b, npm run lint, npm run test:run (1538 tests), npm run build, and the three.js chunk check passed.

The Playground at /playground loaded Monaco with line numbers and syntax highlighting. Typing const dompurifyCheck = 1; showed up in the editor, and Run executed the buffer: the console printed the sample output and the step view listed dompurifyCheck.