[main] Fix npm audit

[nextcloud-command]

Audit report

This audit fix resolves 1 of the total 15 vulnerabilities found in your project.

Updated dependencies

• dompurify

Fixed vulnerabilities

dompurify #

• DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
• Severity: moderate
• Reference: GHSA-55q2-fjhq-7xh7
• Affected versions: <=3.4.12
• Package usage:
  • node_modules/dompurify

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b8f05fe0-be58-40e7-a1bd-02fc64110b7a

📥 Commits

Reviewing files that changed from the base of the PR and between acb342f and 283f4c8.

⛔ Files ignored due to path filters (3)

• js/app_api-adminSettings.js.map is excluded by !**/*.map
• js/app_api-filesplugin.js.map is excluded by !**/*.map
• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (10)

• js/app_api-adminSettings.js
• js/app_api-adminSettings.js.license
• js/app_api-filesplugin.js
• js/app_api-node_modules_nextcloud_dialogs_dist_chunks_PublicAuthPrompt-uFWxS9Cy_mjs.js.license
• js/app_api-vendors-node_modules_mdi_js_mdi_js-node_modules_nextcloud_dialogs_dist_chunks_preview-BIbJGxX-e6bda3.js.license
• js/app_api-vendors-node_modules_nextcloud_dialogs_dist_chunks_ConflictPicker-D-B-WV0C_mjs.js.license
• js/app_api-vendors-node_modules_nextcloud_dialogs_dist_chunks_FilePicker-W-IYpVkn_mjs.js.license
• js/app_api-vendors-node_modules_nextcloud_dialogs_dist_chunks__plugin-vue_export-helper-1tPrXgE0_mjs-nod-dc4ad5.js.license
• js/app_api-vendors-node_modules_nextcloud_vue_dist_components_NcColorPicker_index_mjs.js.license
• js/app_api-vendors-node_modules_nextcloud_vue_dist_components_NcDateTimePicker_index_mjs.js.license

---

📝 Walkthrough

Walkthrough

Updated generated license metadata in eight JavaScript bundle files. Each entry changes the recorded dompurify version from 3.4.12 to 3.4.13. No exported or public declarations changed.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies an npm audit fix, which matches the dependency update for the dompurify vulnerability.
Description check	✅ Passed	The description directly explains the dompurify update and the moderate-severity XSS vulnerability it addresses.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}