Bump sanitize-html from 2.17.2 to 2.17.3

[dependabot]

Bumps sanitize-html from 2.17.2 to 2.17.3.

Changelog

Sourced from sanitize-html's changelog.

2.17.3 (2026-04-15)

Security

• Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

Commits

• 96cf174 For release only (#5381)
• 7ca2d16 Merge commit from fork
• 297a422 Bump dependencies (#5376)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

Greptile Summary

This PR bumps sanitize-html from 2.17.2 to 2.17.3 to patch an XSS vulnerability introduced in 2.17.2 that affected developers who explicitly allowed option tags. The project's own sanitize-rich-text.ts config does not include option in ALLOWED_TAGS, so it was not exposed to the specific vulnerability — but upgrading is still the right defensive move.

Beyond the intended bump, the pnpm-lock.yaml also contains additional unrelated changes worth being aware of:

• libc field stripped from dozens of optional platform-specific packages (e.g. @img/sharp-*, @rollup/rollup-linux-*, @tailwindcss/oxide-*, lightningcss-linux-*, @napi-rs/canvas-*). This appears to be a pnpm lock-file format change from regenerating the lock file.
• @preact/signals-core bumped from 1.14.0 → 1.14.1, an unrelated dependency that was not mentioned in the PR description.
• postcss bumped from 8.5.8 → 8.5.10 as a transitive dependency of sanitize-html@2.17.3.

Confidence Score: 5/5

Safe to merge — the security fix is correct and the project was not vulnerable to the patched CVE, making this a low-risk improvement.

The sanitize-html bump is a targeted patch-level security fix. The project's own sanitization config does not allow option tags, so it was never exposed to the vulnerability. The extra lock file noise (libc field removals, @preact/signals-core bump) is worth noting but carries very low practical risk in standard deployment environments. No application logic changed.

pnpm-lock.yaml — review the libc field removals and the unannounced @preact/signals-core bump if using musl/Alpine Docker images in CI/CD.

Important Files Changed

Filename	Overview
package.json	Single line change: bumps sanitize-html specifier from ^2.17.2 to ^2.17.3 — clean and correct.
pnpm-lock.yaml	Updates sanitize-html resolution and its postcss transitive dep; also strips libc fields from many optional platform packages and bumps @preact/signals-core — changes beyond what the PR description covers.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["sanitize-html@2.17.2\n(XSS vuln if option tags allowed)"] -->|"bump"| B["sanitize-html@2.17.3\n(XSS fix)"]
    B --> C["postcss@8.5.10\n(transitive dep bump)"]
    D["src/lib/server/sanitize-rich-text.ts\nALLOWED_TAGS does NOT include option"] -->|"not vulnerable\nbut good practice"| B
    E["pnpm install side-effects"] --> F["@preact/signals-core\n1.14.0 → 1.14.1"]
    E --> G["libc fields stripped\nfrom optional platform packages"]

Loading

_{Reviews (1): Last reviewed commit: "Bump sanitize-html from 2.17.2 to 2.17.3" | Re-trigger Greptile}

[greptile-apps]

Unexpected libc field removal across many optional packages

The lock file strips the libc constraint from dozens of platform-specific optional packages (e.g. @img/sharp-libvips-linux-arm64, @rollup/rollup-linux-arm64-gnu, @tailwindcss/oxide-linux-arm64-gnu, lightningcss-linux-arm64-gnu, @napi-rs/canvas-linux-arm64-gnu, and many more), which is not related to the sanitize-html bump.

The libc field is what pnpm uses to skip installing glibc binaries on musl-based Linux hosts (e.g. Alpine Docker images) and vice-versa. Removing these fields means pnpm will fall back to the OS-level resolution heuristic alone, which typically works in practice but could lead to installing the wrong native binary variant on edge-case Linux environments.

This looks like the lock file was regenerated with a different pnpm version (or after pnpm install touched other packages). It's low-risk in most setups, but worth confirming that the CI/CD environment and any Alpine/musl Docker images still resolve sharp, rollup, tailwindcss oxide, and canvas binaries correctly after this change.

[greptile-apps]

Undescribed @preact/signals-core version bump

@preact/signals-core is bumped from 1.14.0 → 1.14.1 here, but this change is not mentioned in the PR description. It appears to be a side effect of running pnpm install alongside the sanitize-html update rather than an intentional upgrade. If this was unintentional, consider reverting it to keep the PR focused, or add a note acknowledging it.