[dependabot]

Bumps sanitize-html from 2.18.0 to 2.18.1.

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

• Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

  This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

• Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

  Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

Commits

• a48dd9f Latest release q4 m1 2026: changelog, package.json (#5667)
• 06e4b37 Latest reconciliation q4 m1 2026 (#5664)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/elements/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ec38febf-7598-4a25-8d07-ce41f6e59a7d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

HTML sanitization of nested discarded iframes now stops after a fixed depth instead of recursing until a stack overflow. The plan checks sanitizer version, validation failures, and stack overflow errors. An issue escalates when validation throws or when more markup is stripped than before.

Not monitored: no services

Mention @change-monitor in a comment to update the plan.

Plan

What changed

Template validation now depends on sanitize-html 2.18.1. Nested discarded iframe fallback is sanitized at most eight levels. The nestingLimit count now carries into that nested sanitizer call.

No catalog service ships this change. The package publishes to npm as a local agent extension. The lockfile still records sanitize-html 2.18.0. Runtime 2.18.1 is live only after a publish that installs the new pin.

Template validation allows iframe tags. Discarded iframe fallback should stay uncommon.

Risk

A wrong wildcard merge of class or style rules can strip or keep the wrong markup. A wrong iframe fallback cap can throw RangeError or drop nested fallback HTML. The blast radius is local HTML validation in the published extension. Hosted docs and other workspace packages still use sanitize-html 2.18.0.

Intended effect

The new behavior is nested discarded iframe HTML sanitizing without a stack overflow. Production telemetry cannot show that effect.

Absent looks like the published package still resolving sanitize-html 2.18.0. Absent also looks like RangeError still thrown on nested iframe markup.

Regression watch

This pin can break HTML template validation and validation after HTML edits. The user-visible symptom is RangeError on nested iframe HTML or a rise in validation failures. Sibling tools in the same extension can fail to register if the install graph breaks.

This plan has no measured baseline. See Not observable.

Not observable

Datadog is not connected in this session and needs re-authorization or repair. The executor cannot query RangeError logs, validation failure logs, or error rates. Local console events elements.auto_validation.validation_failed and elements.tool.registration_failed are not ingested. There is no pre-ship rate for the local validation population. The lockfile still specifies sanitize-html 2.18.0, so resolved runtime version is unverified. Sanitized HTML output diffs have no telemetry.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.