From a1c243dd158f89e5352968e18ee713788f01f47e Mon Sep 17 00:00:00 2001
From: Guido X Jansen <x@gui.do>
Date: Tue, 17 Mar 2026 21:11:53 +0100
Subject: [PATCH] fix(security): force undici >=7.24.0 to resolve
 GHSA-f269-vfmq-vjvj (#227)

* fix(security): force undici >=7.24.0 to resolve GHSA-f269-vfmq-vjvj

Adds pnpm override for undici to fix HIGH severity vulnerability:
- CVE: GHSA-f269-vfmq-vjvj
- Issue: Malicious WebSocket 64-bit length overflows parser
- Path: isomorphic-dompurify > jsdom > undici
- Fixed versions: >=7.24.0

* chore: update lockfile for undici override
---
 package.json   |  5 +++++
 pnpm-lock.yaml | 19 ++++++++-----------
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/package.json b/package.json
index f30e21a..ea62e4a 100644
--- a/package.json
+++ b/package.json
@@ -106,5 +106,10 @@
     "typescript": "catalog:",
     "vitest": "catalog:",
     "vitest-axe": "0.1.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "undici": ">=7.24.0"
+    }
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6eadfe3..f576b09 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -34,6 +34,9 @@ catalogs:
       specifier: 4.3.6
       version: 4.3.6
 
+overrides:
+  undici: '>=7.24.0'
+
 importers:
 
   .:
@@ -5177,12 +5180,8 @@ packages:
   undici-types@7.18.2:
     resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
 
-  undici@6.23.0:
-    resolution: {integrity: sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==}
-    engines: {node: '>=18.17'}
-
-  undici@7.21.0:
-    resolution: {integrity: sha512-Hn2tCQpoDt1wv23a68Ctc8Cr/BHpUSfaPYrkajTXOS9IKpxVRx/X5m1K2YkbK2ipgZgxXSgsUinl3x+2YdSSfg==}
+  undici@7.24.4:
+    resolution: {integrity: sha512-BM/JzwwaRXxrLdElV2Uo6cTLEjhSb3WXboncJamZ15NgUURmvlXvxa6xkwIOILIjPNo9i8ku136ZvWV0Uly8+w==}
     engines: {node: '>=20.18.1'}
 
   unique-string@2.0.0:
@@ -7931,7 +7930,7 @@ snapshots:
       parse5: 7.3.0
       parse5-htmlparser2-tree-adapter: 7.1.0
       parse5-parser-stream: 7.1.2
-      undici: 6.23.0
+      undici: 7.24.4
       whatwg-mimetype: 4.0.0
 
   chrome-launcher@0.13.4:
@@ -9312,7 +9311,7 @@ snapshots:
       saxes: 6.0.0
       symbol-tree: 3.2.4
       tough-cookie: 6.0.0
-      undici: 7.21.0
+      undici: 7.24.4
       w3c-xmlserializer: 5.0.0
       webidl-conversions: 8.0.1
       whatwg-mimetype: 5.0.0
@@ -10869,9 +10868,7 @@ snapshots:
 
   undici-types@7.18.2: {}
 
-  undici@6.23.0: {}
-
-  undici@7.21.0: {}
+  undici@7.24.4: {}
 
   unique-string@2.0.0:
     dependencies:
-- 
2.51.2