chore(deps): dompurify 3.4.12, adm-zip 0.6.0

[tomkdgun]

Description

Update dependencies to address CVEs

• dompurify 3.4.11 -> 3.4.12
• adm-zip 0.5.18 -> 0.6.0 (dev)
• brace-expansion 5.0.7 -> 5.0.8
• ip-address 10.2.0 -> 10.3.1 to address https://nvd.nist.gov/vuln/detail/CVE-2026-54272

Fix cypress_workflow_with_s3, top-level env reference in jobs env is not allowed
(Line: 46, Col: 32): Unrecognized named-value: 'env'. Located at position 1 within expression: env.LATEST_VERSION

Issues Resolved

closes #12473
closes #12419

after merge pull request below can be closed as obsolete:
#12474

Screenshot

Testing the changes

Check List

• All tests pass
  • yarn test:jest
  • yarn test:jest_integration
• New functionality includes testing.
• New functionality has been documented.
• Commits are signed per the DCO using --signoff

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 72476c3.

⛔ Hard block: Issues at High severity or above will block this PR from merging.

Path	Line	Severity	Description
package.json	143	high	Dependency change: new resolution entry '**/adm-zip' pinned to '^0.6.0' added. This is a major version bump (0.5.x → 0.6.0) for a ZIP-handling library with broad glob scope ('**/'). Maintainers must verify artifact authenticity at registry.
yarn.lock	6576	high	Dependency change: adm-zip resolved version changed from 0.5.18 to 0.6.0 with new integrity hash. Supply chain rule mandates flagging — verify the published artifact at registry.yarnpkg.com matches expectations.
package.json	243	high	Dependency change: dompurify bumped from '^3.4.11' to '^3.4.12'. This is a security-critical sanitization library; any version change must be verified to ensure the published package has not been tampered with.
yarn.lock	9695	high	Dependency change: dompurify resolved version changed from 3.4.11 to 3.4.12 with new integrity hash. Being the primary XSS-prevention library in the project, maintainers should verify the new release notes and artifact integrity.
packages/osd-utils/package.json	15	high	Dependency change: ip-address bumped from '^10.2.0' to '^10.3.1'. Used in network/CIDR logic; maintainers must verify artifact authenticity at registry.
yarn.lock	12519	high	Dependency change: ip-address resolved version changed from 10.2.0 to 10.3.1 with new integrity hash. The accompanying test change (updated error message) is consistent with a real upstream change, but artifact authenticity still requires verification.
yarn.lock	7626	high	Dependency change: brace-expansion bumped from 5.0.7 to 5.0.8 in lockfile only (no corresponding package.json change visible). Transitive-only lockfile bumps can indicate dependency confusion or silent substitution; maintainers should verify which direct dependency pulled the new version.
.github/workflows/cypress_workflow_with_s3.yml	46	low	CI workflow changed from using dynamic env variable '${{ env.LATEST_VERSION }}' to hardcoded version '3.4.0' for the OpenSearch snapshot install command. This pins CI to a specific version, preventing automatic pickup of newer/patched releases, but has plausible intent (test reproducibility).

The table above displays the top 10 most important findings.

Total: 8 | Critical: 0 | High: 7 | Medium: 0 | Low: 1

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

✅ All unit and integration tests passing

🔗 Workflow run · commit 72476c31e32f7a3e85271235941bfd43507137a3

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (7782a80) to head (72476c3).
⚠️ Report is 354 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main   #12477       +/-   ##
===========================================
- Coverage   61.58%        0   -61.59%     
===========================================
  Files        4995        0     -4995     
  Lines      137542        0   -137542     
  Branches    23901        0    -23901     
===========================================
- Hits        84707        0    -84707     
+ Misses      46692        0    -46692     
+ Partials     6143        0     -6143     

Flag	Coverage Δ
Linux_1	?
Linux_2	?
Linux_3	?
Linux_4	?
Linux_5	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ruanyl]

Is this change by intention?

[tomkdgun]

Yes, it's error existing in main visible on CI logs, top-level env variables can't be resolved inside jobs env variables.

[ruanyl]

I see, that seems was introduced by https://github.com/opensearch-project/OpenSearch-Dashboards/pull/12413/changes, can you share a example error CI logs? maybe link to the CI outputs

[tomkdgun]

It's on description (Line: 46, Col: 32): Unrecognized named-value: 'env'. Located at position 1 within expression: env.LATEST_VERSION