[Omar-AlJaljuli]

Hey, I just made a Pull Request!

upgrade dompurify to 0.57.0 by bumping monaco-editor to 0.57.0 through the lightspeed plugin package.json and running a 'yarn install'. Bumps dompurify to 3.4.15
Fixes
CVE-2026-75838
RHIDP-16569

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-1.10/lightspeed@bcd91ab). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                    Coverage Diff                     @@
##             release-1.10/lightspeed    #5287   +/-   ##
==========================================================
  Coverage                           ?   60.96%           
==========================================================
  Files                              ?     2098           
  Lines                              ?    65167           
  Branches                           ?    16940           
==========================================================
  Hits                               ?    39726           
  Misses                             ?    25219           
  Partials                           ?      222           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (?)		Carriedforward from 0d9b887
ai-integrations	70.03% <ø> (?)		Carriedforward from 0d9b887
app-defaults	69.60% <ø> (?)		Carriedforward from 0d9b887
augment	69.36% <ø> (?)		Carriedforward from 0d9b887
bulk-import	72.86% <ø> (?)		Carriedforward from 0d9b887
cost-management	16.49% <ø> (?)		Carriedforward from 0d9b887
dcm	32.85% <ø> (?)		Carriedforward from 0d9b887
extensions	61.79% <ø> (?)		Carriedforward from 0d9b887
global-floating-action-button	74.30% <ø> (?)		Carriedforward from 0d9b887
global-header	61.68% <ø> (?)		Carriedforward from 0d9b887
homepage	50.95% <ø> (?)		Carriedforward from 0d9b887
konflux	91.01% <ø> (?)		Carriedforward from 0d9b887
lightspeed	68.13% <ø> (?)
mcp-integrations	81.59% <ø> (?)		Carriedforward from 0d9b887
orchestrator	36.36% <ø> (?)		Carriedforward from 0d9b887
quickstart	62.88% <ø> (?)		Carriedforward from 0d9b887
sandbox	79.56% <ø> (?)		Carriedforward from 0d9b887
scorecard	83.58% <ø> (?)		Carriedforward from 0d9b887
theme	64.54% <ø> (?)		Carriedforward from 0d9b887
translations	8.49% <ø> (?)		Carriedforward from 0d9b887
x2a	78.28% <ø> (?)		Carriedforward from 0d9b887

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bcd91ab...f358bd4. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[JessicaJHee]

/lgtm

✅ Verified target branch

• Base is release-1.10/lightspeed (active naming; not deprecated lightspeed/release-1.10)

✅ Verified packages have been updated to the patched versions or beyond

• Claimed full fixes in lightspeed match advisories (yarn why in workspaces/lightspeed/)

✅ Verified lockfile (workspaces/lightspeed/yarn.lock):

• Minimal expected updates only (monaco-editor + nested dompurify)
• No dependency version downgrades
• No unexpected @backstage/* bumps