[dependabot]

Bumps sanitize-html from 2.18.0 to 2.18.1.

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

• Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

  This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

• Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

  Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

Commits

• a48dd9f Latest release q4 m1 2026: changelog, package.json (#5667)
• 06e4b37 Latest reconciliation q4 m1 2026 (#5664)
• See full diff in compare view

[netlify]

✅ Deploy Preview succeeded!

Name	Link
🔨 Latest commit	6343a7b
🔍 Latest deploy log	https://app.netlify.com/projects/tigera/deploys/6ad9fdaa8f03d46f3c744aa9
😎 Deploy Preview	https://deploy-preview-3155--tigera.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 89 (🟢 up 16 from production) Accessibility: 98 (no change from production) Best Practices: 92 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for calico-docs-preview-next ready!

Name	Link
🔨 Latest commit	6343a7b
🔍 Latest deploy log	https://app.netlify.com/projects/calico-docs-preview-next/deploys/6ad9fdab4090bb5f99e51b44
😎 Deploy Preview	https://deploy-preview-3155--calico-docs-preview-next.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

🟢 Approval recommended

The dependency update addresses the reported vulnerability and contains no unresolved review issues.

No open issues 🎉

What changed in this PR

Updates sanitize-html from 2.18.0 to 2.18.1, incorporating the upstream iframe recursion security fix and removing its unnecessary deepmerge dependency.

Changes:

• Bumps the direct dependency to ^2.18.1.
• Refreshes the Yarn lockfile, checksum, and dependency metadata.
• Removes deepmerge from sanitize-html’s locked dependency graph.

File	Description
package.json	Updates the declared sanitize-html dependency.
yarn.lock	Locks sanitize-html at 2.18.1 and reflects its updated dependencies.

_{Review effort: Lite}