Skip to content

chore(main): release slack-block-kit-validator 0.1.11 - #61

Merged
StephenTangCook merged 1 commit into
mainfrom
release-please--branches--main--components--slack-block-kit-validator
Jul 22, 2026
Merged

chore(main): release slack-block-kit-validator 0.1.11#61
StephenTangCook merged 1 commit into
mainfrom
release-please--branches--main--components--slack-block-kit-validator

chore(main): release slack-block-kit-validator 0.1.11

bb993b5
Select commit
Loading
Failed to load commit list.
Fencer Code / Fencer succeeded Jul 22, 2026 in 4m 0s

Fencer Scan Results

Checks

0 checks failed · 0 failing · 1 passing

  • Audit mode — PASS — 21 vulnerabilities found. Scan is in audit mode and will not fail. Configure thresholds to enable checks.

Hint: You can configure the checks on the repository settings page.

Scan metadata

  • scan: #473830 · branch release-please--branches--main--components--slack-block-kit-validator · sha bb993b59f6bd
  • open: 21 — critical=0 high=11 medium=6 low=4 info=0
  • new: 0 — critical=0 high=0 medium=0 low=0 info=0
  • new-secrets: 0
  • resolved: 0
  • ignored: 0

Pre-existing vulnerabilities (21, showing 10)

Present on the base branch before this scan.

VULN-BX5 — HIGH

  • id: VULN-BX5
  • rule: innerHTML Assignment From Untrusted Data (Cross-Site Scripting)
  • severity: HIGH
  • state: pre-existing (present on the base branch)
  • scope: repo
  • location: demo/src/main.ts:162
  • title: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • description: aboutEl.innerHTML = ABOUT_COPY[surface] inside setActiveSurface is an anti-pattern that can lead to XSS. If ABOUT_COPY[surface] carries any user-controlled data, this is an XSS sink. Trace ABOUT_COPY[surface] back to its definition to confirm whether it is reachable from untrusted input. Prefer textContent, sanitize with DOMPurify, or use an auto-escaping templating framework.
  • remediation: https://owasp.org/Top10/A03_2021-Injection
  • AI verdict: False positive
  • AI summary: The code writes ABOUT_COPY[surface] into innerHTML, but ABOUT_COPY is a hard‑coded map of static strings and the surface key is derived only from a trusted data‑surface attribute or from click handlers that restrict it to a known set of literal values (“message”, “modal”, “home”). Because no attacker‑controlled data ever reaches the lookup, the content assigned to innerHTML is guaranteed to be safe, eliminating any XSS risk.

VULN-BX6 — HIGH

  • id: VULN-BX6
  • rule: innerHTML Assignment From Untrusted Data (Cross-Site Scripting)
  • severity: HIGH
  • state: pre-existing (present on the base branch)
  • scope: repo
  • location: demo/src/main.ts:182
  • title: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • description: presetBlurbEl.innerHTML = html inside setBlurb is an anti-pattern that can lead to XSS. If html carries any user-controlled data, this is an XSS sink. Trace html back to its definition to confirm whether it is reachable from untrusted input. Prefer textContent, sanitize with DOMPurify, or use an auto-escaping templating framework.
  • remediation: https://owasp.org/Top10/A03_2021-Injection
  • AI verdict: False positive
  • AI summary: setBlurb writes its html argument directly to element.innerHTML, but the only value ever passed comes from DEFAULT_BLURB[surface], a hard‑coded constant map defined in the codebase. Because that map is not populated from any user‑controlled input, the source of the data is trusted and no malicious content can reach the innerHTML sink. Consequently, there is no exploitable XSS path and the finding is a false positive.

VULN-BX7 — HIGH

VULN-BX8 — HIGH

VULN-BX9 — HIGH

  • id: VULN-BX9
  • rule: Vite dev server filesystem deny bypass on Windows alternate paths
  • severity: HIGH
  • state: pre-existing (present on the base branch)
  • scope: repo
  • location: pnpm-lock.yaml
  • title: Vulnerable package: vite@8.0.12
  • description: Found 2 vulnerabilities in package vite version 8.0.12. Upgrade to version 8.0.16 to fix these issues.
  • remediation: Update dependency. References: GHSA-fx2h-pf6j-xcff, https://nvd.nist.gov/vuln/detail/CVE-2026-53571

VULN-BXA — HIGH

  • id: VULN-BXA
  • rule: CORS Middleware Reflects Origin When Using Wildcard with Credentials
  • severity: HIGH
  • state: pre-existing (present on the base branch)
  • scope: repo
  • location: pnpm-lock.yaml
  • title: Vulnerable package: hono@4.12.21
  • description: Found 8 vulnerabilities in package hono version 4.12.21. Upgrade to version 4.12.27 to fix these issues.
  • remediation: Update dependency. References: GHSA-88fw-hqm2-52qc, https://nvd.nist.gov/vuln/detail/CVE-2026-54290

VULN-BXB — HIGH

VULN-BXC — HIGH

VULN-D99 — HIGH

VULN-D9A — HIGH

Showing the first 10 of 21 pre-existing vulnerabilities — see the scan for the rest.

View more details on Fencer Code