fix(ui): patch dependency vulnerabilities flagged by pnpm audit (#12029)

ui/changelog.d/ui-dependency-vulnerabilities.security.md

@@ -0,0 +1 @@
+`js-yaml` to 4.3.0, `@sentry/nextjs` to 10.65.0 with `import-in-the-middle` 3.3.1, and transitive `hono`, `dompurify`, `ws`, `vite`, `@babel/core` and `@opentelemetry/core` to patched versions, resolving 13 npm audit advisories (3 high, 9 moderate, 1 low) plus `hono` CVE-2026-59896, published on NVD but not yet in the npm audit feed

ui/components/auth/oss/social-buttons.test.tsx

@@ -1,8 +1,15 @@
 import { render, screen } from "@testing-library/react";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 
 import { SocialButtons } from "./social-buttons";
 
+// Stub Iconify: the real <Icon> fetches icon data over the network and its
+// retry timers can fire after the jsdom environment is torn down, crashing the
+// worker with "window is not defined".
+vi.mock("@iconify/react", () => ({
+  Icon: ({ icon }: { icon: string }) => <span aria-label={icon} />,
+}));
+
 describe("SocialButtons", () => {
   it("renders icon-only provider links that keep their accessible names", () => {
     render(

ui/dependency-log.json

@@ -306,10 +306,10 @@
   {
     "section": "dependencies",
     "name": "@sentry/nextjs",
-    "from": "10.11.0",
-    "to": "10.27.0",
+    "from": "10.27.0",
+    "to": "10.65.0",
     "strategy": "installed",
-    "generatedAt": "2025-12-15T11:18:25.093Z"
+    "generatedAt": "2026-07-16T15:35:58.334Z"
   },
   {
     "section": "dependencies",
@@ -435,17 +435,17 @@
     "section": "dependencies",
     "name": "import-in-the-middle",
     "from": "2.0.0",
-    "to": "2.0.0",
+    "to": "3.3.1",
     "strategy": "installed",
-    "generatedAt": "2025-12-16T08:33:37.278Z"
+    "generatedAt": "2026-07-16T15:35:58.334Z"
   },
   {
     "section": "dependencies",
     "name": "js-yaml",
-    "from": "4.1.0",
-    "to": "4.1.1",
+    "from": "4.1.1",
+    "to": "4.3.0",
     "strategy": "installed",
-    "generatedAt": "2025-12-15T11:18:25.093Z"
+    "generatedAt": "2026-07-16T15:29:57.887Z"
   },
   {
     "section": "dependencies",

ui/lib/yaml.test.ts

@@ -55,4 +55,43 @@ describe("validateYaml", () => {
     // Then
     expect(result.isValid).toBe(false);
   });
+
+  // Users author these documents by hand in the Mutelist and Scan Configuration
+  // editors, so anchors, aliases and merge keys are legitimate input the syntax
+  // check must keep accepting across js-yaml upgrades (4.3.0 rewrote merge-key
+  // handling for CVE-2026-59869).
+  it("accepts anchors, aliases and merge keys", () => {
+    // When
+    const result = validateYaml(
+      [
+        "defaults: &defaults",
+        "  max_unused_access_keys_days: 45",
+        "aws:",
+        "  <<: *defaults",
+        "  max_console_access_days: 45",
+      ].join("\n"),
+    );
+
+    // Then
+    expect(result.isValid).toBe(true);
+  });
+
+  it("rejects a merge-key amplification document (CVE-2026-59869 shape)", () => {
+    // Given — each mapping merges the previous one and adds a distinct key, so
+    // merged-key copies grow quadratically (~45k total here). js-yaml 4.3.0
+    // fixes the CVE by capping that work (maxTotalMergeKeys) and rejecting the
+    // document; a vulnerable parser accepts it instead, turning the assertion
+    // below red without relying on timing or suite timeouts.
+    const chain = ["a0: &a0 { k0: 0 }"];
+    for (let i = 1; i < 300; i++) {
+      chain.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`);
+    }
+
+    // When
+    const result = validateYaml(chain.join("\n"));
+
+    // Then
+    expect(result.isValid).toBe(false);
+    expect(result.error).toMatch(/merge keys/i);
+  });
 });

ui/package.json

@@ -73,7 +73,7 @@
     "@react-aria/visually-hidden": "3.8.12",
     "@react-stately/utils": "3.10.8",
     "@react-types/shared": "3.26.0",
-    "@sentry/nextjs": "10.27.0",
+    "@sentry/nextjs": "10.65.0",
     "@tailwindcss/postcss": "4.1.18",
     "@tailwindcss/typography": "0.5.16",
     "@tanstack/react-table": "8.21.3",
@@ -89,8 +89,8 @@
     "date-fns": "4.1.0",
     "driver.js": "1.4.0",
     "framer-motion": "11.18.2",
-    "import-in-the-middle": "2.0.0",
-    "js-yaml": "4.1.1",
+    "import-in-the-middle": "3.3.1",
+    "js-yaml": "4.3.0",
     "jwt-decode": "4.0.0",
     "langchain": "1.4.0",
     "lucide-react": "0.543.0",

ui/pnpm-workspace.yaml

@@ -19,7 +19,13 @@ overrides:
   "@react-aria/interactions>react": "19.2.7"
   "lodash": "4.18.1"
   "lodash-es": "4.18.1"
-  "hono": "4.12.21"
+  # GHSA-88fw-hqm2-52qc (CORS reflects any Origin with credentials) + 4 moderate
+  # advisories (serve-static path traversal, Lambda Set-Cookie merge, body-limit
+  # bypass, Lambda@Edge repeated-header loss), all fixed in 4.12.25, plus
+  # CVE-2026-59896 (hono/jsx SSR context leak across concurrent requests; in NVD
+  # but not yet in the npm audit feed), fixed in 4.12.27. Not 4.12.29: it is
+  # still inside StepSecurity's 7-day npm cooldown gate.
+  "hono": "4.12.28"
   "@hono/node-server": "1.19.14"
   "@isaacs/brace-expansion": "5.0.1"
   "fast-xml-parser": "5.8.0"
@@ -27,6 +33,29 @@ overrides:
   "postcss": "8.5.14"
   "esbuild": "0.28.1"
   "rollup@>=4": "4.59.0"
+  # GHSA-fx2h-pf6j-xcff (server.fs.deny bypass on Windows alternate paths, high) +
+  # GHSA-v6wh-96g9-6wx3 (launch-editor NTLMv2 hash disclosure). Dev-only tooling
+  # (vitest/@vitejs/plugin-react); consumers allow ^7 but never resolve past 7.3.2
+  # without a nudge.
+  "vite@>=7 <8": "7.3.5"
+  # GHSA-96hv-2xvq-fx4p (memory exhaustion DoS from tiny fragments, high) +
+  # GHSA-58qx-3vcg-4xpx (uninitialized memory disclosure), both fixed in 8.21.0.
+  # Not 8.21.1: it is still inside StepSecurity's 7-day npm cooldown gate.
+  "ws@>=8 <9": "8.21.0"
+  # Pulled by @sentry/server-utils bundler plugins (^2.1.0). Pinned because the
+  # latest 2.3.1 is still inside StepSecurity's 7-day npm cooldown gate; safe to
+  # drop this pin after 2026-07-20.
+  "es-module-lexer": "2.3.0"
+  # GHSA-4x5r-pxfx-6jf8 (arbitrary file read via sourceMappingURL comment, low),
+  # fixed in 7.29.1. An override instead of `pnpm update` so the rest of the
+  # babel/browserslist subtree keeps its existing lockfile resolutions.
+  "@babel/core": "7.29.7"
+  # Ephemeral cooldown pins: the @babel/helper-compilation-targets refresh pulls
+  # browserslist-ecosystem releases newer than StepSecurity's 7-day npm cooldown.
+  # Safe to drop after 2026-07-20.
+  "browserslist": "4.28.2"
+  "caniuse-lite": "1.0.30001792"
+  "baseline-browser-mapping": "2.10.29"
   "minimatch@<4": "3.1.4"
   "minimatch@>=9 <10": "9.0.7"
   "minimatch@>=10": "10.2.3"
@@ -42,9 +71,9 @@ overrides:
   # but the override unifies the tree on a patched version.
   "uuid": "11.1.1"
   # GHSA-vxr8-fq34-vvx9 (+ several related XSS sanitization bypasses): DOMPurify < 3.4.9,
-  # pulled in transitively via streamdown > mermaid (which wants ^3.3.1). Pinned to 3.4.10
-  # (fixes all open advisories; 3.4.11 is < 24h old and blocked by minimumReleaseAge).
-  "dompurify": "3.4.10"
+  # pulled in transitively via streamdown > mermaid (which wants ^3.3.1). Bumped to 3.4.11
+  # for GHSA-cmwh-pvxp-8882 (permanent ALLOWED_ATTR pollution via setConfig()).
+  "dompurify": "3.4.11"
 
 # --- Level 1: Minimum Release Age ---
 # Packages must be published for at least 1 day before they can be installed.