chore(deps): bump sanitize-html from 2.17.1 to 2.17.5 in /packages/frontend by dependabot[bot] · Pull Request #1247 · yojo-art/cherrypick

dependabot · 2026-07-31T23:28:12Z

Bumps sanitize-html from 2.17.1 to 2.17.5.

Changelog

Sourced from sanitize-html's changelog.

2.17.5 (2026-06-10)

Security

Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.

Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.

2.17.4

Changes

sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

Commits

2427508 release and changelog edits (#5465)
5a88e96 Latest security q2 (#5464)
958d162 merge main to latest (#5460)
e9b0ab0 release only (changelogs formatted) (#5408)
f03fa5b Latest security merge (#5407)
96cf174 For release only (#5381)
7ca2d16 Merge commit from fork
297a422 Bump dependencies (#5376)
7e607c9 Changelog reconciliation for release (#5359)
49d0bb7 Port/sanitize html community contrib (#5337)
See full diff in compare view

github-actions · 2026-07-31T23:30:27Z

❌ Docker 起動・検証に失敗しました

エラーログ

…（省略）
 [TITLE]  Unzipping Cypress        66% 2s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        67% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        68% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        69% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        70% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        71% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        72% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        73% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        74% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        75% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        76% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        77% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        78% 1s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        78% 2s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipping Cypress        100% 0s
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Unzipped Cypress       
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [SUCCESS]  Unzipped Cypress       
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [STARTED] Task without title.
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [TITLE]  Finished Installation   /root/.cache/Cypress/15.7.1
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: [SUCCESS]  Finished Installation   /root/.cache/Cypress/15.7.1
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: You can now open Cypress by running one of the following, depending on your package manager:
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: - npx cypress open
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: - yarn cypress open
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: - pnpm cypress open
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: https://on.cypress.io/opening-the-app
#42 45.48 .../cypress@15.7.1/node_modules/cypress postinstall: Done
#42 48.78 .../node_modules/@tensorflow/tfjs-node install$ node scripts/install.js
#42 48.78 .../node_modules/@tensorflow/tfjs-node install: CPU-linux-4.22.0.tar.gz
#42 48.78 .../node_modules/@tensorflow/tfjs-node install: * Downloading libtensorflow
#42 48.78 .../node_modules/@tensorflow/tfjs-node install: https://storage.googleapis.com/tensorflow/libtensorflow/libtensorflow-cpu-linux-x86_64-2.9.1.tar.gz
#42 48.78 .../node_modules/@tensorflow/tfjs-node install: * Building TensorFlow Node.js bindings
#42 48.78 .../node_modules/@tensorflow/tfjs-node install: Done
#42 51.65 
#42 51.65 dependencies:
#42 51.65 + esbuild 0.28.1
#42 51.65 + execa 9.6.1
#42 51.65 + ignore-walk 8.0.0
#42 51.65 + js-yaml 4.3.0
#42 51.65 + tar 7.5.21
#42 51.65 + typescript 5.9.3
#42 51.65 
#42 51.65 optionalDependencies:
#42 51.65 + @tensorflow/tfjs-core 4.22.0
#42 51.65 
#42 51.65 devDependencies:
#42 51.65 + @biomejs/biome 2.3.1
#42 51.65 + @eslint/js 9.39.1
#42 51.65 + @misskey-dev/eslint-plugin 2.2.0
#42 51.65 + @types/js-yaml 4.0.9
#42 51.65 + @types/node 24.10.2
#42 51.65 + @typescript-eslint/eslint-plugin 8.49.0
#42 51.65 + @typescript-eslint/parser 8.49.0
#42 51.65 + cross-env 10.1.0
#42 51.65 + cypress 15.7.1
#42 51.65 + eslint 9.39.1
#42 51.65 + globals 16.5.0
#42 51.65 + ncp 2.0.0
#42 51.65 + pnpm 10.34.4
#42 51.65 + start-server-and-test 2.1.2
#42 51.65 
#42 52.07 Done in 51.9s using pnpm v10.28.2
#42 DONE 60.1s

#41 [native-builder 19/23] RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked 	pnpm i --frozen-lockfile --aggregate-output
#41 60.63 Scope: all 12 workspace projects
#41 60.77  ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with <ROOT>/packages/frontend/package.json
#41 60.77 
#41 60.77 Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"
#41 60.77 
#41 60.77   Failure reason:
#41 60.77   specifiers in the lockfile don't match specifiers in package.json:
#41 60.77 * 1 dependencies are mismatched:
#41 60.77   - sanitize-html (lockfile: 2.17.0, manifest: 2.17.5)
#41 60.77 
#41 ERROR: process "/bin/sh -c pnpm i --frozen-lockfile --aggregate-output" did not complete successfully: exit code: 1
------
 > [native-builder 19/23] RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked 	pnpm i --frozen-lockfile --aggregate-output:
60.63 Scope: all 12 workspace projects
60.77  ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with <ROOT>/packages/frontend/package.json
60.77 
60.77 Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"
60.77 
60.77   Failure reason:
60.77   specifiers in the lockfile don't match specifiers in package.json:
60.77 * 1 dependencies are mismatched:
60.77   - sanitize-html (lockfile: 2.17.0, manifest: 2.17.5)
60.77 
------
Dockerfile:38

--------------------

  37 |     

  38 | >>> RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \

  39 | >>> 	pnpm i --frozen-lockfile --aggregate-output

  40 |     

--------------------

failed to solve: process "/bin/sh -c pnpm i --frozen-lockfile --aggregate-output" did not complete successfully: exit code: 1

github-actions · 2026-08-01T01:56:48Z

❌ Docker 起動・検証に失敗しました

エラーログ

…（省略）
9 2.279 npm notice New major version of npm available! 11.16.0 -> 12.0.2
#39 2.279 npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.0.2
#39 2.279 npm notice To update run: npm install -g npm@12.0.2
#39 2.279 npm notice
#39 DONE 2.5s

#40 [native-builder 19/23] RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked 	pnpm i --frozen-lockfile --aggregate-output
#40 ...

#41 [target-builder 11/12] RUN node -e "console.log(JSON.parse(require('node:fs').readFileSync('./package.json')).packageManager)" | xargs npm install -g
#41 2.459 
#41 2.459 added 1 package in 2s
#41 2.461 
#41 2.461 1 package is looking for funding
#41 2.461   run `npm fund` for details
#41 2.462 npm notice
#41 2.462 npm notice New major version of npm available! 11.16.0 -> 12.0.2
#41 2.462 npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.0.2
#41 2.462 npm notice To update run: npm install -g npm@12.0.2
#41 2.462 npm notice
#41 DONE 2.6s

#13 [runner  2/18] RUN apt-get update 	&& apt-get install -y --no-install-recommends 	ffmpeg tini curl libjemalloc-dev libjemalloc2 	&& ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so 	&& groupadd -g "991" misskey 	&& useradd -l -u "991" -g "991" -m -d /cherrypick misskey 	&& find / -type d -path /sys -prune -o -type d -path /proc -prune -o -type f -perm /u+s -ignore_readdir_race -exec chmod u-s {} ; 	&& find / -type d -path /sys -prune -o -type d -path /proc -prune -o -type f -perm /g+s -ignore_readdir_race -exec chmod g-s {} ; 	&& apt-get clean 	&& rm -rf /var/lib/apt/lists
#13 19.28 Selecting previously unselected package libsensors-config.
#13 19.28 Preparing to unpack .../179-libsensors-config_1%3a3.6.0-7.1_all.deb ...
#13 19.28 Unpacking libsensors-config (1:3.6.0-7.1) ...
#13 19.31 Selecting previously unselected package libsensors5:amd64.
#13 19.31 Preparing to unpack .../180-libsensors5_1%3a3.6.0-7.1_amd64.deb ...
#13 19.31 Unpacking libsensors5:amd64 (1:3.6.0-7.1) ...
#13 19.33 Selecting previously unselected package libgl1-mesa-dri:amd64.
#13 19.34 Preparing to unpack .../181-libgl1-mesa-dri_22.3.6-1+deb12u2_amd64.deb ...
#13 19.34 Unpacking libgl1-mesa-dri:amd64 (22.3.6-1+deb12u2) ...
#13 19.88 Selecting previously unselected package libglx-mesa0:amd64.
#13 19.88 Preparing to unpack .../182-libglx-mesa0_22.3.6-1+deb12u2_amd64.deb ...
#13 19.88 Unpacking libglx-mesa0:amd64 (22.3.6-1+deb12u2) ...
#13 19.92 Selecting previously unselected package libglx0:amd64.
#13 19.92 Preparing to unpack .../183-libglx0_1.6.0-1_amd64.deb ...
#13 19.92 Unpacking libglx0:amd64 (1.6.0-1) ...
#13 19.95 Selecting previously unselected package libgl1:amd64.
#13 19.95 Preparing to unpack .../184-libgl1_1.6.0-1_amd64.deb ...
#13 19.95 Unpacking libgl1:amd64 (1.6.0-1) ...
#13 19.98 Selecting previously unselected package libiec61883-0:amd64.
#13 ...

#40 [native-builder 19/23] RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked 	pnpm i --frozen-lockfile --aggregate-output
#40 0.785 Scope: all 12 workspace projects
#40 1.017  ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with <ROOT>/packages/frontend/package.json
#40 1.017 
#40 1.017 Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"
#40 1.017 
#40 1.017   Failure reason:
#40 1.017   specifiers in the lockfile don't match specifiers in package.json:
#40 1.017 * 1 dependencies are mismatched:
#40 1.017   - sanitize-html (lockfile: 2.17.0, manifest: 2.17.5)
#40 1.017 
#40 ERROR: process "/bin/sh -c pnpm i --frozen-lockfile --aggregate-output" did not complete successfully: exit code: 1

#42 [target-builder 12/12] RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked 	pnpm i --frozen-lockfile --aggregate-output
#42 CANCELED

#13 [runner  2/18] RUN apt-get update 	&& apt-get install -y --no-install-recommends 	ffmpeg tini curl libjemalloc-dev libjemalloc2 	&& ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so 	&& groupadd -g "991" misskey 	&& useradd -l -u "991" -g "991" -m -d /cherrypick misskey 	&& find / -type d -path /sys -prune -o -type d -path /proc -prune -o -type f -perm /u+s -ignore_readdir_race -exec chmod u-s {} ; 	&& find / -type d -path /sys -prune -o -type d -path /proc -prune -o -type f -perm /g+s -ignore_readdir_race -exec chmod g-s {} ; 	&& apt-get clean 	&& rm -rf /var/lib/apt/lists
#13 19.98 Preparing to unpack .../185-libiec61883-0_1.2.0-6+b1_amd64.deb ...
#13 19.98 Unpacking libiec61883-0:amd64 (1.2.0-6+b1) ...
#13 20.01 Selecting previously unselected package libsamplerate0:amd64.
#13 20.01 Preparing to unpack .../186-libsamplerate0_0.2.2-3_amd64.deb ...
#13 20.01 Unpacking libsamplerate0:amd64 (0.2.2-3) ...
#13 CANCELED
------
 > [native-builder 19/23] RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked 	pnpm i --frozen-lockfile --aggregate-output:
0.785 Scope: all 12 workspace projects
1.017  ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with <ROOT>/packages/frontend/package.json
1.017 
1.017 Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"
1.017 
1.017   Failure reason:
1.017   specifiers in the lockfile don't match specifiers in package.json:
1.017 * 1 dependencies are mismatched:
1.017   - sanitize-html (lockfile: 2.17.0, manifest: 2.17.5)
1.017 
------
Dockerfile:38

--------------------

  37 |     

  38 | >>> RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \

  39 | >>> 	pnpm i --frozen-lockfile --aggregate-output

  40 |     

--------------------

failed to solve: process "/bin/sh -c pnpm i --frozen-lockfile --aggregate-output" did not complete successfully: exit code: 1

Bumps [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) from 2.17.1 to 2.17.5. - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html) --- updated-dependencies: - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-11T13:09:14Z

❌ Docker 起動・検証に失敗しました

エラーログ

…（省略）
e -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so 	&& groupadd -g "991" misskey 	&& useradd -l -u "991" -g "991" -m -d /cherrypick misskey 	&& find / -type d -path /sys -prune -o -type d -path /proc -prune -o -type f -perm /u+s -ignore_readdir_race -exec chmod u-s {} ; 	&& find / -type d -path /sys -prune -o -type d -path /proc -prune -o -type f -perm /g+s -ignore_readdir_race -exec chmod g-s {} ; 	&& apt-get clean 	&& rm -rf /var/lib/apt/lists
#13 15.54 Preparing to unpack .../161-libglapi-mesa_22.3.6-1+deb12u2_amd64.deb ...
#13 15.54 Unpacking libglapi-mesa:amd64 (22.3.6-1+deb12u2) ...
#13 15.56 Selecting previously unselected package libxcb-dri2-0:amd64.
#13 15.56 Preparing to unpack .../162-libxcb-dri2-0_1.15-1_amd64.deb ...
#13 15.56 Unpacking libxcb-dri2-0:amd64 (1.15-1) ...
#13 15.58 Selecting previously unselected package libxcb-glx0:amd64.
#13 15.58 Preparing to unpack .../163-libxcb-glx0_1.15-1_amd64.deb ...
#13 15.58 Unpacking libxcb-glx0:amd64 (1.15-1) ...
#13 15.60 Selecting previously unselected package libxcb-present0:amd64.
#13 15.61 Preparing to unpack .../164-libxcb-present0_1.15-1_amd64.deb ...
#13 15.61 Unpacking libxcb-present0:amd64 (1.15-1) ...
#13 15.64 Selecting previously unselected package libxcb-randr0:amd64.
#13 15.64 Preparing to unpack .../165-libxcb-randr0_1.15-1_amd64.deb ...
#13 15.64 Unpacking libxcb-randr0:amd64 (1.15-1) ...
#13 15.67 Selecting previously unselected package libxcb-sync1:amd64.
#13 15.67 Preparing to unpack .../166-libxcb-sync1_1.15-1_amd64.deb ...
#13 15.67 Unpacking libxcb-sync1:amd64 (1.15-1) ...
#13 15.70 Selecting previously unselected package libxcb-xfixes0:amd64.
#13 15.70 Preparing to unpack .../167-libxcb-xfixes0_1.15-1_amd64.deb ...
#13 15.70 Unpacking libxcb-xfixes0:amd64 (1.15-1) ...
#13 15.72 Selecting previously unselected package libxshmfence1:amd64.
#13 15.72 Preparing to unpack .../168-libxshmfence1_1.3-1_amd64.deb ...
#13 15.72 Unpacking libxshmfence1:amd64 (1.3-1) ...
#13 15.73 Selecting previously unselected package libxxf86vm1:amd64.
#13 15.73 Preparing to unpack .../169-libxxf86vm1_1%3a1.1.4-1+b2_amd64.deb ...
#13 15.74 Unpacking libxxf86vm1:amd64 (1:1.1.4-1+b2) ...
#13 15.75 Selecting previously unselected package libdrm-amdgpu1:amd64.
#13 15.75 Preparing to unpack .../170-libdrm-amdgpu1_2.4.114-1+b1_amd64.deb ...
#13 15.75 Unpacking libdrm-amdgpu1:amd64 (2.4.114-1+b1) ...
#13 15.76 Selecting previously unselected package libpciaccess0:amd64.
#13 15.76 Preparing to unpack .../171-libpciaccess0_0.17-2_amd64.deb ...
#13 15.76 Unpacking libpciaccess0:amd64 (0.17-2) ...
#13 15.78 Selecting previously unselected package libdrm-intel1:amd64.
#13 15.78 Preparing to unpack .../172-libdrm-intel1_2.4.114-1+b1_amd64.deb ...
#13 15.78 Unpacking libdrm-intel1:amd64 (2.4.114-1+b1) ...
#13 15.80 Selecting previously unselected package libdrm-nouveau2:amd64.
#13 15.80 Preparing to unpack .../173-libdrm-nouveau2_2.4.114-1+b1_amd64.deb ...
#13 15.80 Unpacking libdrm-nouveau2:amd64 (2.4.114-1+b1) ...
#13 15.81 Selecting previously unselected package libdrm-radeon1:amd64.
#13 15.82 Preparing to unpack .../174-libdrm-radeon1_2.4.114-1+b1_amd64.deb ...
#13 15.82 Unpacking libdrm-radeon1:amd64 (2.4.114-1+b1) ...
#13 15.83 Selecting previously unselected package libelf1:amd64.
#13 15.83 Preparing to unpack .../175-libelf1_0.188-2.1_amd64.deb ...
#13 15.83 Unpacking libelf1:amd64 (0.188-2.1) ...
#13 15.86 Selecting previously unselected package libedit2:amd64.
#13 15.86 Preparing to unpack .../176-libedit2_3.1-20221030-2_amd64.deb ...
#13 15.86 Unpacking libedit2:amd64 (3.1-20221030-2) ...
#13 15.88 Selecting previously unselected package libz3-4:amd64.
#13 15.88 Preparing to unpack .../177-libz3-4_4.8.12-3.1_amd64.deb ...
#13 15.88 Unpacking libz3-4:amd64 (4.8.12-3.1) ...
#13 CANCELED

#41 [native-builder 19/23] RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked 	pnpm i --frozen-lockfile --aggregate-output
#41 0.636 Scope: all 12 workspace projects
#41 0.854  ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with <ROOT>/packages/frontend/package.json
#41 0.854 
#41 0.854 Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"
#41 0.854 
#41 0.854   Failure reason:
#41 0.854   specifiers in the lockfile don't match specifiers in package.json:
#41 0.854 * 1 dependencies are mismatched:
#41 0.854   - sanitize-html (lockfile: 2.17.1, manifest: 2.17.5)
#41 0.854 
#41 ERROR: process "/bin/sh -c pnpm i --frozen-lockfile --aggregate-output" did not complete successfully: exit code: 1

#42 [target-builder 12/12] RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked 	pnpm i --frozen-lockfile --aggregate-output
#42 CANCELED
------
 > [native-builder 19/23] RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked 	pnpm i --frozen-lockfile --aggregate-output:
0.636 Scope: all 12 workspace projects
0.854  ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with <ROOT>/packages/frontend/package.json
0.854 
0.854 Note that in CI environments this setting is true by default. If you still need to run install in such cases, use "pnpm install --no-frozen-lockfile"
0.854 
0.854   Failure reason:
0.854   specifiers in the lockfile don't match specifiers in package.json:
0.854 * 1 dependencies are mismatched:
0.854   - sanitize-html (lockfile: 2.17.1, manifest: 2.17.5)
0.854 
------
Dockerfile:38

--------------------

  37 |     

  38 | >>> RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \

  39 | >>> 	pnpm i --frozen-lockfile --aggregate-output

  40 |     

--------------------

failed to solve: process "/bin/sh -c pnpm i --frozen-lockfile --aggregate-output" did not complete successfully: exit code: 1

dependabot · 2026-09-02T02:46:49Z

Superseded by #1331.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 31, 2026

github-actions Bot added the packages/frontend label Jul 31, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/frontend/sanitize-html-2.17.5 branch from 84991c3 to fe8f30a Compare August 1, 2026 01:49

dependabot Bot changed the title ~~chore(deps): bump sanitize-html from 2.17.0 to 2.17.5 in /packages/frontend~~ chore(deps): bump sanitize-html from 2.17.1 to 2.17.5 in /packages/frontend Aug 11, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/frontend/sanitize-html-2.17.5 branch from fe8f30a to 9fc2609 Compare August 11, 2026 12:59

dependabot Bot closed this Sep 2, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/packages/frontend/sanitize-html-2.17.5 branch September 2, 2026 02:46

Navigation Menu

chore(deps): bump sanitize-html from 2.17.1 to 2.17.5 in /packages/frontend - #1247

chore(deps): bump sanitize-html from 2.17.1 to 2.17.5 in /packages/frontend#1247
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/packages/frontend/sanitize-html-2.17.5

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Aug 1, 2026

Uh oh!

github-actions Bot commented Aug 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.17.5 (2026-06-10)

Security

2.17.4

Changes

Security

2.17.3 (2026-04-15)

Security

2.17.2 (2026-03-19)

Changes

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Aug 1, 2026

Uh oh!

github-actions Bot commented Aug 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading