Page MenuHomePhabricator

Surface externally managed Wikibase OAD in the REST Sandbox for projects where it is enabled
Open, In Progress, MediumPublic2 Estimated Story Points

Description

Description

The Wikidata team has created a high quality spec. As of right now, the MediaWiki REST framework cannot support generation on all fields and features utilized in that spec. To ensure we are delivering the best possible developer experience, we should opt to surface the high quality spec instead of the default generated API module spec.

Conditions of acceptance

  • Wikibase is available as an API module in the REST Sandbox dropdown on projects where the extension is installed
  • Wikibase module points to the higher quality spec defined and owned by the WMDE Wikidata team
  • Remove Wikibase routes from MediaWiki 'flat route' structure to avoid confusion and conflicting information

Implementation details

The high quality spec can be retrieved through this endpoint: https://www.wikidata.org/w/rest.php/wikibase/v1/openapi.json

Because this is a manually managed spec, we expect that the server option will not be correct at this time. By default, the server options will include "example" and "Wikidata" as options on all Wikis.

OPEN QUESTIONS:

  1. Is there any meaningful divide between what is defined as wikidata vs wikibase in this case? the base URL is specifically connected to the Wikidata project, but is presented as the Wikibase REST API.
  2. Is there a way for us to populate the server field dynamically? Perhaps by specifying a parameter when requesting the spec from Wikidata? --> this would have a dependency on the Wikidata team.

Event Timeline

BPirkle triaged this task as Medium priority.Apr 6 2026, 6:53 PM
BPirkle moved this task from Incoming (Needs Triage) to Backlog on the MW-Interfaces-Team board.

It looks like our swagger-ui version only supports 3.0.x openapi specs, not the 3.1.0 spec that this endpoint returns. Upgrading the swagger-ui-bundle/swagger-ui-standalone-preset files will require an Application Security Review like T325558. They do show when I tried the 5.32.4 dist files, however I had to use ?debug=1 to avoid ResourceLoader truncating a line (which caused syntax errors).

Ideally, per https://www.mediawiki.org/wiki/Compatibility, ES2017 would be enough to work.

Playing around with https://eslint.org/play/ and an unminify site, even the lowest version of swagger-ui-bundle.js from a release that supports openapi 3.1, namely the v5.0.0 release, still runs into ES2018 errors. The use of empty try/catch requires ES2019. The use of ?? and ?. requires ES2020.

If we are OK with requiring ES2020, then v5.0.0 can be considered. Actually, for fun, I tested the current v4.15.5 version and it still needs ES2020. So I guess bumping to 5.0.0 would be no worse than now. This is at https://github.com/swagger-api/swagger-ui/tree/v5.0.0 .

aaron changed the task status from In Progress to Stalled.May 5 2026, 3:00 PM

Checking with with https://eslint.org/play/ , I looked for the newest 5.x.x version that still works with ES2020. We may as well include the usual bug fixes that occur when supporting anything new (e.g. openapi 3.1). Here is how following swagger-ui-bundle.js versions work with ES2020:

  • 5.15.2 (no)
  • 5.8.0 (no)
  • 5.5.0 (yes)
  • 5.6.2 (yes)
  • 5.7.2 (no)

For swagger-ui-standalone-preset.js:

  • 5.7.2 (no)
  • 5.6.2 (yes)

So, it looks like 5.6.2 is specifically the newest version with the same ES2020 compatibility. I also tested using those files in resources/libs with the restsandbox locally with the wikibase spec JSON and it works fine.

I don't see any new direct non-dev dependencies:

git diff v4.15.5 v5.6.2 -U10 -- package.json
   "dependencies": {
-    "@babel/runtime-corejs3": "^7.18.9",
-    "@braintree/sanitize-url": "=6.0.0",
+    "@babel/runtime-corejs3": "^7.22.11",
+    "@braintree/sanitize-url": "=6.0.4",
     "base64-js": "^1.5.1",
     "classnames": "^2.3.1",
     "css.escape": "1.5.1",
     "deep-extend": "0.6.0",
-    "dompurify": "=2.3.10",
+    "dompurify": "=3.0.5",
     "ieee754": "^1.2.1",
     "immutable": "^3.x.x",
     "js-file-download": "^0.4.12",
     "js-yaml": "=4.1.0",
     "lodash": "^4.17.21",
-    "patch-package": "^6.5.0",
+    "patch-package": "^8.0.0",
     "prop-types": "^15.8.1",
     "randexp": "^0.5.3",
     "randombytes": "^2.1.0",
     "react": "=17.0.2",
     "react-copy-to-clipboard": "5.1.0",
     "react-debounce-input": "=3.3.0",
     "react-dom": "=17.0.2",
     "react-immutable-proptypes": "2.2.0",
     "react-immutable-pure-component": "^2.2.0",
     "react-inspector": "^6.0.1",
-    "react-redux": "^7.2.4",
+    "react-redux": "^8.1.2",
     "react-syntax-highlighter": "^15.5.0",
     "redux": "^4.1.2",
     "redux-immutable": "^4.0.0",
     "remarkable": "^2.0.1",
-    "reselect": "^4.1.5",
+    "reselect": "^4.1.8",
     "serialize-error": "^8.1.0",
     "sha.js": "^2.4.11",
-    "swagger-client": "^3.18.5",
-    "url-parse": "^1.5.8",
+    "swagger-client": "^3.20.0",
+    "url-parse": "^1.5.10",
     "xml": "=1.0.1",
     "xml-but-prettier": "^1.0.1",
     "zenscroll": "^4.0.2"
   },

Similar with direct dev dependencies:

   "devDependencies": {
-    "@babel/cli": "=7.16.8",
-    "@babel/core": "=7.14.6",
-    "@babel/eslint-parser": "=7.19.1",
-    "@babel/plugin-proposal-class-properties": "=7.16.7",
-    "@babel/plugin-proposal-nullish-coalescing-operator": "=7.18.6",
-    "@babel/plugin-proposal-object-rest-spread": "=7.19.4",
-    "@babel/plugin-proposal-optional-chaining": "=7.18.9",
-    "@babel/plugin-transform-modules-commonjs": "=7.16.8",
-    "@babel/plugin-transform-runtime": "=7.18.9",
-    "@babel/preset-env": "=7.20.2",
-    "@babel/preset-react": "=7.14.5",
-    "@babel/register": "=7.17.0",
-    "@commitlint/cli": "^16.2.1",
-    "@commitlint/config-conventional": "^16.2.1",
-    "@jest/globals": "=27.0.6",
-    "@pmmmwh/react-refresh-webpack-plugin": "^0.5.4",
+    "@babel/cli": "=7.22.10",
+    "@babel/core": "=7.22.11",
+    "@babel/eslint-parser": "=7.22.11",
+    "@babel/plugin-transform-class-properties": "=7.22.5",
+    "@babel/plugin-transform-nullish-coalescing-operator": "=7.22.11",
+    "@babel/plugin-transform-object-rest-spread": "=7.22.15",
+    "@babel/plugin-transform-optional-chaining": "=7.22.15",
+    "@babel/plugin-transform-runtime": "=7.22.10",
+    "@babel/preset-env": "=7.22.14",
+    "@babel/preset-react": "=7.22.5",
+    "@babel/register": "=7.22.5",
+    "@commitlint/cli": "^17.7.1",
+    "@commitlint/config-conventional": "^17.7.0",
+    "@jest/globals": "=29.6.4",
+    "@pmmmwh/react-refresh-webpack-plugin": "^0.5.11",
     "@release-it/conventional-changelog": "=5.1.0",
-    "@wojtekmaj/enzyme-adapter-react-17": "=0.6.6",
-    "autoprefixer": "^10.4.12",
-    "babel-loader": "^8.2.3",
+    "@wojtekmaj/enzyme-adapter-react-17": "=0.8.0",
+    "autoprefixer": "^10.4.15",
+    "babel-loader": "^9.1.3",
     "babel-plugin-lodash": "=3.3.4",
-    "babel-plugin-module-resolver": "=4.1.0",
+    "babel-plugin-module-resolver": "=5.0.0",
     "babel-plugin-transform-react-remove-prop-types": "=0.4.24",
     "body-parser": "^1.19.0",
     "buffer": "^6.0.3",
     "cors": "^2.8.5",
     "cross-env": "=7.0.3",
-    "css-loader": "=6.7.1",
-    "cssnano": "=5.1.12",
-    "cypress": "=9.5.1",
-    "dedent": "^0.7.0",
-    "deepmerge": "^4.0.0",
+    "css-loader": "=6.8.1",
+    "cssnano": "=6.0.1",
+    "cypress": "=12.17.4",
+    "dedent": "^1.5.1",
+    "deepmerge": "^4.3.1",
     "enzyme": "=3.11.0",
-    "eslint": "^8.20.0",
-    "eslint-plugin-import": "^2.25.4",
-    "eslint-plugin-jest": "^26.1.1",
-    "eslint-plugin-mocha": "^9.0.0",
-    "eslint-plugin-react": "^7.27.1",
+    "eslint": "^8.48.0",
+    "eslint-plugin-import": "^2.28.1",
+    "eslint-plugin-jest": "^27.2.2",
+    "eslint-plugin-mocha": "^10.1.0",
+    "eslint-plugin-react": "^7.33.2",
     "esm": "=3.2.25",
-    "expect": "=28.1.3",
+    "expect": "=29.6.4",
     "express": "^4.18.2",
     "git-describe": "^4.1.0",
-    "html-webpack-plugin": "^5.5.0",
+    "html-webpack-plugin": "^5.5.1",
     "html-webpack-skip-assets-plugin": "^1.0.3",
-    "husky": "=7.0.4",
+    "husky": "=8.0.3",
     "inspectpack": "=4.7.1",
-    "jest": "=28.1.3",
-    "jest-environment-jsdom": "=28.1.3",
-    "jsdom": "=20.0.0",
+    "jest": "=29.6.3",
+    "jest-environment-jsdom": "=29.6.4",
+    "jest-transform-stub": "=2.0.0",
+    "jsdom": "=22.1.0",
     "json-loader": "^0.5.7",
-    "json-merger": "^1.1.9",
-    "json-server": "=0.17.0",
-    "less": "^4.1.2",
+    "json-merger": "^1.1.10",
+    "json-server": "=0.17.3",
+    "less": "^4.2.0",
     "license-checker": "^25.0.0",
-    "lint-staged": "=11.2.6",
-    "local-web-server": "^4.2.1",
-    "mini-css-extract-plugin": "^2.6.1",
+    "lint-staged": "^14.0.1",
+    "local-web-server": "^5.3.0",
+    "mini-css-extract-plugin": "^2.7.6",
     "mocha": "=8.4.0",
     "npm-audit-ci-wrapper": "^3.0.2",
     "npm-run-all": "^4.1.5",
     "oauth2-server": "^2.4.1",
-    "open": "^8.4.0",
-    "postcss": "^8.4.14",
-    "postcss-loader": "^7.0.1",
-    "postcss-preset-env": "^7.4.3",
-    "prettier": "^2.7.1",
+    "open": "^9.1.0",
+    "postcss": "^8.4.28",
+    "postcss-loader": "^7.3.0",
+    "postcss-preset-env": "^9.1.2",
+    "prettier": "^3.0.2",
     "process": "^0.11.10",
-    "react-refresh": "^0.11.0",
+    "react-refresh": "^0.14.0",
     "react-test-renderer": "=17.0.2",
     "release-it": "=15.4.2",
-    "rimraf": "^3.0.0",
-    "sass": "^1.54.0",
-    "sass-loader": "^12.6.0",
-    "sinon": "=12.0.1",
+    "rimraf": "^5.0.1",
+    "sass": "^1.66.1",
+    "sass-loader": "^13.3.0",
+    "sinon": "=15.2.0",
     "source-map-support": "^0.5.21",
-    "start-server-and-test": "^1.14.0",
+    "start-server-and-test": "^2.0.0",
     "stream-browserify": "^3.0.0",
     "tachyons-sass": "^4.9.5",
-    "terser-webpack-plugin": "^5.3.6",
-    "webpack": "^5.65.0",
+    "terser-webpack-plugin": "^5.3.8",
+    "webpack": "^5.88.1",
     "webpack-bundle-size-analyzer": "^3.1.0",
     "webpack-cli": "^4.10.0",
-    "webpack-dev-server": "^4.7.4",
+    "webpack-dev-server": "^4.15.0",
     "webpack-node-externals": "=3.0.0",
-    "webpack-stats-plugin": "=1.0.3"
+    "webpack-stats-plugin": "=1.1.3"
   },

From npm audit of 5.6.2:

# npm audit report

@babel/runtime  <7.26.10
Severity: moderate
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
fix available via `npm audit fix`
node_modules/@babel/runtime

@babel/runtime-corejs3  <7.26.10
Severity: moderate
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - https://github.com/advisories/GHSA-968p-4wvh-cqc8
fix available via `npm audit fix`
node_modules/@babel/runtime-corejs3

axios  1.0.0 - 1.15.1
Severity: high
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
Server-Side Request Forgery in axios - https://github.com/advisories/GHSA-8hc4-vh64-cxmj
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - https://github.com/advisories/GHSA-jr5f-v2jv-69x6
Axios is vulnerable to DoS attack through lack of data size check - https://github.com/advisories/GHSA-4hjh-wcwx-xvwj
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - https://github.com/advisories/GHSA-43fc-jf86-j433
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF - https://github.com/advisories/GHSA-3p68-rc4w-qgx5
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - https://github.com/advisories/GHSA-fvcv-3m26-pcqx
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - https://github.com/advisories/GHSA-w9j2-pvgh-6h63
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 - https://github.com/advisories/GHSA-pmwg-cvhr-8vh7
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - https://github.com/advisories/GHSA-3w6x-2g7m-8v23
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - https://github.com/advisories/GHSA-q8qp-cvcw-x6jj
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams - https://github.com/advisories/GHSA-xhjh-pmcv-23jw
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream - https://github.com/advisories/GHSA-445q-vr5w-6q77
Axios: no_proxy bypass via IP alias allows SSRF - https://github.com/advisories/GHSA-m7pr-hjqh-92cm
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - https://github.com/advisories/GHSA-62hf-57xw-28j9
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 - https://github.com/advisories/GHSA-5c9x-8gcm-mpgx
Axios: HTTP adapter streamed responses bypass maxContentLength - https://github.com/advisories/GHSA-vf2m-468p-8v99
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking - https://github.com/advisories/GHSA-pf86-5x62-jrwf
Axios: Header Injection via Prototype Pollution - https://github.com/advisories/GHSA-6chq-wfr3-2hj9
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion - https://github.com/advisories/GHSA-xx6v-rp6x-q39c
fix available via `npm audit fix`
node_modules/axios

brace-expansion  <=1.1.12 || 2.0.0 - 2.0.2
Severity: moderate
brace-expansion Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
brace-expansion Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
fix available via `npm audit fix`
node_modules/@swagger-api/apidom-reference/node_modules/brace-expansion
node_modules/brace-expansion

braces  <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
fix available via `npm audit fix`
node_modules/braces

cookie  <0.7.0
cookie accepts cookie name, path, and domain with out of bounds characters - https://github.com/advisories/GHSA-pxg6-pf52-xh8x
fix available via `npm audit fix`
node_modules/cookie
  swagger-client  3.3.0 - 3.29.3
  Depends on vulnerable versions of cookie
  node_modules/swagger-client

cross-spawn  7.0.0 - 7.0.4
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix`
node_modules/cross-spawn

dompurify  <=3.3.3
Severity: high
DOMPurify allows tampering by prototype pollution - https://github.com/advisories/GHSA-mmhx-hmjr-r674
DOMPurify allows Cross-site Scripting (XSS) - https://github.com/advisories/GHSA-vhxf-7vqr-mrjg
DOMpurify has a nesting-based mXSS - https://github.com/advisories/GHSA-gx9m-whjm-85jf
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization  - https://github.com/advisories/GHSA-h8r8-wccr-v5f2
DOMPurify ADD_ATTR predicate skips URI validation - https://github.com/advisories/GHSA-cjmm-f4jc-qw8r
DOMPurify USE_PROFILES prototype pollution allows event handlers - https://github.com/advisories/GHSA-cj63-jhhr-wcxv
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation - https://github.com/advisories/GHSA-39q2-94rc-95cp
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) - https://github.com/advisories/GHSA-h7mw-gpvr-xq4m
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode - https://github.com/advisories/GHSA-crv5-9vww-q3g8
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback - https://github.com/advisories/GHSA-v9jr-rg53-9pgp
fix available via `npm audit fix --force`
Will install dompurify@3.4.2, which is outside the stated dependency range
node_modules/dompurify

follow-redirects  <=1.15.11
Severity: moderate
follow-redirects' Proxy-Authorization header kept across hosts - https://github.com/advisories/GHSA-cxjh-pqwp-8mfp
Follow Redirects improperly handles URLs in the url.parse() function - https://github.com/advisories/GHSA-jchw-25xp-jwwc
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets - https://github.com/advisories/GHSA-r4q5-vmmm-2653
fix available via `npm audit fix`
node_modules/follow-redirects

form-data  4.0.0 - 4.0.3
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
fix available via `npm audit fix`
node_modules/axios/node_modules/form-data

immutable  <3.8.3
Severity: high
Immutable is vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-wf6x-7x77-mvgw
fix available via `npm audit fix`
node_modules/immutable

js-yaml  4.0.0 - 4.1.0
Severity: moderate
js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m
fix available via `npm audit fix --force`
Will install js-yaml@4.1.1, which is outside the stated dependency range
node_modules/js-yaml

lodash  <=4.17.23
Severity: high
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
fix available via `npm audit fix`
node_modules/lodash

micromatch  <4.0.8
Severity: moderate
Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv
fix available via `npm audit fix`
node_modules/micromatch

minimatch  <=3.1.3 || 7.0.0 - 7.4.7
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@swagger-api/apidom-reference/node_modules/minimatch
node_modules/minimatch

picomatch  <=2.3.1
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/picomatch

prismjs  <1.30.0
Severity: moderate
PrismJS DOM Clobbering vulnerability - https://github.com/advisories/GHSA-x7hr-w5r2-h6wg
fix available via `npm audit fix --force`
Will install react-syntax-highlighter@16.1.1, which is a breaking change
node_modules/prismjs
node_modules/refractor/node_modules/prismjs
  refractor  <=4.6.0
  Depends on vulnerable versions of prismjs
  node_modules/refractor
    react-syntax-highlighter  6.0.0 - 15.6.6
    Depends on vulnerable versions of refractor
    node_modules/react-syntax-highlighter

qs  <=6.14.1
Severity: moderate
qs's arrayLimit bypass in comma parsing allows denial of service - https://github.com/advisories/GHSA-w7fw-mjwx-w883
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
fix available via `npm audit fix`
node_modules/qs

sha.js  <=2.4.11
Severity: critical
sha.js is missing type checks leading to hash rewind and passing on crafted data - https://github.com/advisories/GHSA-95m3-7q98-8xr5
fix available via `npm audit fix`
node_modules/sha.js

tar-fs  2.0.0 - 2.1.3
Severity: high
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball - https://github.com/advisories/GHSA-vj76-c3g6-qr5v
tar-fs can extract outside the specified dir with a specific tarball - https://github.com/advisories/GHSA-8cj5-5rvv-wf4v
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File - https://github.com/advisories/GHSA-pq67-2wwv-3xjx
fix available via `npm audit fix`
node_modules/tar-fs

tmp  <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
fix available via `npm audit fix`
node_modules/patch-package/node_modules/tmp
  patch-package  <=8.0.0 || >=8.1.0-canary
  Depends on vulnerable versions of tmp
  node_modules/patch-package

yaml  2.0.0 - 2.8.2
Severity: moderate
yaml is vulnerable to Stack Overflow via deeply nested YAML collections - https://github.com/advisories/GHSA-48c2-rrv3-qjmp
fix available via `npm audit fix`
node_modules/yaml

26 vulnerabilities (4 low, 11 moderate, 9 high, 2 critical)

Note that ES2020 issue matters since I our JS minifier gives bad output for code with some of the newer ES constructs. 5.6.2 was the highest version I tested that avoided the sandbox-breaking "Uncaught SyntaxError: Invalid or unexpected token" error from the load.php call that pulls in the swagger bundle. No specs are rendered since the bad JS cannot be parsed.

Note that ES2020 issue matters since I our JS minifier gives bad output for code with some of the newer ES constructs. 5.6.2 was the highest version I tested that avoided the sandbox-breaking "Uncaught SyntaxError: Invalid or unexpected token" error from the load.php call that pulls in the swagger bundle. No specs are rendered since the bad JS cannot be parsed.

The latest SwaggerUI also uses "static" keyword from ES2022. The minifier will be able to handle this once T425100 is resolved.

aaron changed the status of subtask Restricted Task from Open to Stalled.Jun 2 2026, 3:02 PM
sbassett closed subtask Restricted Task as Resolved.Jun 3 2026, 10:00 PM
sbassett reopened subtask Restricted Task as In Progress.
aaron changed the task status from Stalled to In Progress.Tue, Jun 30, 3:42 PM
aaron closed subtask Restricted Task as Resolved.Tue, Jul 14, 3:52 PM