Has anyone ever successfully gotten rid of all the vulnerabi Umbraco #package-development

Has anyone ever successfully gotten rid of all the...

Kevin Jump

04/07/2026, 10:21 AM

Has anyone ever successfully gotten rid of all the vulnerability warnings in a umbraco extension ? something i check before doing releases, and at the moment there are all sorts (even in the v17.3.0 extension package) apprently handlebars is a thing and its in

@heyapi/openapi-ts

so you have to update that past v0.85, and it has breaking changes (shock horror!) - but they are fixed in yet more config. but then i get

Copy code

dompurify  <=3.3.1
Severity: moderate
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization  - https://github.com/advisories/GHSA-h8r8-wccr-v5f2
DOMPurify contains a Cross-site Scripting vulnerability - https://github.com/advisories/GHSA-v2wj-7wpq-c8vv
DOMPurify ADD_ATTR predicate skips URI validation - https://github.com/advisories/GHSA-cjmm-f4jc-qw8r
DOMPurify USE_PROFILES prototype pollution allows event handlers - https://github.com/advisories/GHSA-cj63-jhhr-wcxv
fix available via `npm audit fix --force`
Will install @umbraco-cms/backoffice@17.0.2, which is a breaking change
node_modules/monaco-editor/node_modules/dompurify
  monaco-editor  >=0.54.0-dev-20250909
  Depends on vulnerable versions of dompurify
  node_modules/monaco-editor
    @umbraco-cms/backoffice  >=17.1.0-rc
    Depends on vulnerable versions of monaco-editor
    node_modules/@umbraco-cms/backoffice

3 moderate severity vulnerabilities

to be clear i am including umbraco v17.3.0 ? (in fact this is from a clean
dotnet new umbraco-extension
on v`17.3.0) what is odd here, is the thing things i need to downgrade the umbraco package to fix the issue?

10 Views

Previous Next