[release-1.10] chore(lightspeed): update monaco-editor to ^0.56.0

[JessicaJHee]

Hey, I just made a Pull Request!

Bumps monaco-editor to ^0.56.0 to help provide full fix in overlays repo for dompurify CVE

• Relates to partial fix PR

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.96%. Comparing base (0476a85) to head (0ae4e33).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                   Coverage Diff                    @@
##           lightspeed/release-1.10    #3911   +/-   ##
========================================================
  Coverage                    60.96%   60.96%           
========================================================
  Files                         2098     2098           
  Lines                        65167    65167           
  Branches                     16940    16942    +2     
========================================================
  Hits                         39726    39726           
  Misses                       25219    25219           
  Partials                       222      222           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (ø)		Carriedforward from 0476a85
ai-integrations	70.03% <ø> (ø)		Carriedforward from 0476a85
app-defaults	69.60% <ø> (ø)		Carriedforward from 0476a85
augment	69.36% <ø> (ø)		Carriedforward from 0476a85
bulk-import	72.86% <ø> (ø)		Carriedforward from 0476a85
cost-management	16.49% <ø> (ø)		Carriedforward from 0476a85
dcm	32.85% <ø> (ø)		Carriedforward from 0476a85
extensions	61.79% <ø> (ø)		Carriedforward from 0476a85
global-floating-action-button	74.30% <ø> (ø)		Carriedforward from 0476a85
global-header	61.68% <ø> (ø)		Carriedforward from 0476a85
homepage	50.95% <ø> (ø)		Carriedforward from 0476a85
konflux	91.01% <ø> (ø)		Carriedforward from 0476a85
lightspeed	68.13% <ø> (ø)
mcp-integrations	81.59% <ø> (ø)		Carriedforward from 0476a85
orchestrator	36.36% <ø> (ø)		Carriedforward from 0476a85
quickstart	62.88% <ø> (ø)		Carriedforward from 0476a85
sandbox	79.56% <ø> (ø)		Carriedforward from 0476a85
scorecard	83.58% <ø> (ø)		Carriedforward from 0476a85
theme	64.54% <ø> (ø)		Carriedforward from 0476a85
translations	8.49% <ø> (ø)		Carriedforward from 0476a85
x2a	78.28% <ø> (ø)		Carriedforward from 0476a85

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0476a85...0ae4e33. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (1) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 14 rules

✅ Cross-repo context

  Explored: repo: redhat-developer/rhdh (branch: release-1.10, sha: da65cdf8)

  Explored: repo: redhat-developer/rhdh-operator (branch: release-1.10, sha: de4cd6fd)

  Explored: repo: redhat-developer/rhdh-local (branch: release-1.10, sha: 3b8742be)

  Not relevant to this PR: redhat-developer/rhdh-chart

1. Outdated dompurify still present 🐞 Bug ⛨ Security

Description

This PR updates monaco-editor to 0.56.0 (bringing in dompurify 3.4.8), but the Lightspeed
workspace yarn.lock still pins dompurify 3.2.6 and 3.3.3 via other dependencies (notably
swagger-ui-react and @backstage/plugin-techdocs). If the intent is to remove older dompurify
versions from the dependency graph (e.g., to satisfy security scanning/remediation goals), this PR
alone doesn’t achieve that.

Code

workspaces/lightspeed/yarn.lock[R28345-28350]

+"monaco-editor@npm:^0.56.0":
+  version: 0.56.0
+  resolution: "monaco-editor@npm:0.56.0"
  dependencies:
-    dompurify: "npm:3.2.7"
+    dompurify: "npm:3.4.8"
    marked: "npm:14.0.0"
-  checksum: 10c0/c1a0cf887657b42c8996518bc5ee96bbd39c977f862d2a2b2018427c45f14b0dd25d1452278202056f6b1ead97981282ccacd7d7ad918d8f0ef084159f974a25

Relevance

⭐⭐⭐ High

Team has accepted lockfile dedupe/security remediation to remove vulnerable/duplicate transitive
versions; this flags incomplete dompurify remediation.

PR-#2246
PR-#1779
PR-#2085

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The lockfile shows Monaco now depends on dompurify@3.4.8, but it also contains other dompurify
resolutions (=3.2.6 and 3.3.3) brought in by swagger-ui-react (used by
@backstage/plugin-api-docs) and by @backstage/plugin-techdocs, meaning older dompurify
versions remain in the workspace dependency graph.

workspaces/lightspeed/yarn.lock[28345-28353]
workspaces/lightspeed/yarn.lock[19970-20004]
workspaces/lightspeed/yarn.lock[3030-3053]
workspaces/lightspeed/yarn.lock[4330-4358]
workspaces/lightspeed/yarn.lock[34696-34738]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`monaco-editor` now pulls `dompurify@3.4.8`, but the workspace still includes older `dompurify` versions (e.g., `=3.2.6`, `3.3.3`) due to other transitive parents. This can keep older `dompurify` versions present in installs/scans even after the Monaco bump.

## Issue Context
Within the Lightspeed workspace, `swagger-ui-react` pins `dompurify` to an exact older version, and `@backstage/plugin-techdocs` depends on a range that resolves to `3.3.3` in the current lockfile.

## Fix Focus Areas
- workspaces/lightspeed/package.json[71-80]
- workspaces/lightspeed/yarn.lock[19970-20005]
- workspaces/lightspeed/yarn.lock[3030-3053]
- workspaces/lightspeed/yarn.lock[4330-4358]
- workspaces/lightspeed/yarn.lock[34696-34738]

## Suggested fix approach
1. Decide whether the goal is to ensure a single (newer) `dompurify` version across the workspace.
2. If yes, add a Yarn (Berry) `resolutions` override in `workspaces/lightspeed/package.json` to force `dompurify` to `3.4.8` (or your desired patched version), then regenerate `workspaces/lightspeed/yarn.lock`.
3. If the override is not compatible, instead upgrade the transitive parents that pin/limit `dompurify` (e.g., the packages that introduce `swagger-ui-react` / older `dompurify` ranges) and re-lock.
4. Verify the lockfile no longer contains the older `dompurify` entries if that is the intended remediation outcome.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Monaco version drift risk 🔗 Cross-repo conflict ☼ Reliability

Description

Lightspeed now pins monaco-editor ^0.56.0 while the Extensions plugin (often enabled alongside
Lightspeed in rhdh-local) remains on ^0.55.0, which may increase client bundle duplication and
raises risk of Monaco-loader/global integration quirks when both are present. Consider aligning the
monaco-editor minor versions across these commonly co-enabled plugins.

Code

workspaces/lightspeed/plugins/lightspeed/package.json[76]

+    "monaco-editor": "^0.56.0",

Relevance

⭐⭐ Medium

Some history of version-alignment concerns (avoid dual Backstage majors), but no prior Monaco
cross-plugin alignment precedent found.

PR-#2672
PR-#2085

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR updates Lightspeed’s monaco-editor to ^0.56.0, while Extensions remains on ^0.55.0 and
actively imports/configures Monaco. rhdh-local’s default dynamic-plugins config enables both plugins
together, making the version skew relevant cross-repo.

workspaces/lightspeed/plugins/lightspeed/package.json[64-77]
workspaces/extensions/plugins/extensions/package.json[63-70]
workspaces/extensions/plugins/extensions/src/components/CodeEditor.tsx[26-41]
External repo: redhat-developer/rhdh-local, configs/dynamic-plugins/dynamic-plugins.yaml [31-63]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Lightspeed is updated to `monaco-editor@^0.56.0`, but Extensions still pins `monaco-editor@^0.55.0`. In environments that commonly enable both (notably `rhdh-local`), this version skew can lead to duplicated Monaco assets and increases the chance of subtle runtime integration issues.

## Issue Context
- `rhdh-local` enables **both** the Extensions dynamic plugin and the Lightspeed dynamic plugin by default.
- Extensions actively imports and configures Monaco.

## Fix Focus Areas
- workspaces/lightspeed/plugins/lightspeed/package.json[64-77]
- workspaces/extensions/plugins/extensions/package.json[63-70]
- workspaces/extensions/plugins/extensions/src/components/CodeEditor.tsx[26-41]

## Suggested fix options
1. Preferred: bump Extensions’ `monaco-editor` to `^0.56.0` as well (with a changeset for `@red-hat-developer-hub/backstage-plugin-extensions`), and validate the Extensions CodeEditor still works.
2. If Lightspeed doesn’t actually need Monaco directly: consider removing the direct `monaco-editor` dependency from Lightspeed (keeping only what’s required by actual imports/usage), so the CVE fix can be addressed where Monaco is truly used.
3. If both must stay: document the version skew and verify both plugins can coexist in `rhdh-local` (and the operator Lightspeed flavour) without Monaco/worker-loader issues.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[rhdh-qodo-merge]

PR Summary by Qodo

chore(lightspeed): bump monaco-editor to ^0.56.0 (dompurify CVE)

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Bump Lightspeed plugin dependency monaco-editor to ^0.56.0.
• Pull in newer transitive dompurify to mitigate CVE exposure.
• Add a patch changeset for the Lightspeed plugin release.

Diagram

graph TD
  LS["Lightspeed plugin"] --> ME["monaco-editor ^0.56.0"] --> DP["dompurify 3.4.8"]
  LS --> CS["changeset (patch)"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Yarn overrides/resolutions for dompurify

• ➕ Targets the vulnerable package directly with minimal surface-area change
• ➕ Avoids any behavior changes from monaco-editor upgrades
• ➖ Creates a non-standard dependency graph vs upstream expectations
• ➖ Can be fragile across future dependency updates and tooling changes

2. Apply a patch-package fix to dompurify usage

• ➕ Can be a fast mitigation if upstream upgrade is blocked
• ➖ High maintenance burden; patches must be rebased on every lockfile change
• ➖ Not ideal for a widely-used transitive dependency

Recommendation: Prefer the PR’s approach (upgrade monaco-editor) because it follows the upstream dependency chain to bring in the dompurify fix without relying on overrides/patches. Consider overrides only if monaco-editor 0.56.0 introduces regressions for the Lightspeed UI.

Files changed (3) +16 / -11

Other (3) +16 / -11

wicked-plants-smash.mdAdd patch changeset for monaco-editor upgrade +5/-0

Add patch changeset for monaco-editor upgrade

• Introduces a changeset to publish a patch release of the Lightspeed plugin. Notes the dependency bump to monaco-editor ^0.56.0.

workspaces/lightspeed/.changeset/wicked-plants-smash.md

package.jsonBump monaco-editor dependency to ^0.56.0 +1/-1

Bump monaco-editor dependency to ^0.56.0

• Updates the Lightspeed plugin’s direct dependency on monaco-editor from ^0.55.0 to ^0.56.0.

workspaces/lightspeed/plugins/lightspeed/package.json

yarn.lockRefresh lockfile for monaco-editor 0.56.0 and dompurify 3.4.8 +10/-10

Refresh lockfile for monaco-editor 0.56.0 and dompurify 3.4.8

• Updates the resolved monaco-editor version to 0.56.0. Also updates transitive dompurify from 3.2.7 to 3.4.8 to align with the new monaco-editor dependency tree.

workspaces/lightspeed/yarn.lock

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[JessicaJHee]

Holding until it has been >3 days since the monaco-editor v0.56.0 release for security reasons

[its-mitesh-kumar]

/lgtm

S_.2026-07-24.at.2.00.43.AM.mov