The importmap pinned a hand-vendored copy of Trix 2.1.19
(vendor/javascript/trix.esm.min.js) that dependency tooling can't see.
The action_text-trix gem already in the bundle ships the same 2.1.19
release as app/assets/javascripts/trix.js and adds it to the asset
precompile list, so pin against that instead and drop the vendored blob.
Trix updates now arrive through ordinary gem bumps, visible to
Dependabot and security advisories.
The gem's build is UMD rather than ESM, which makes no difference here:
application.js imports "trix" only for its side effect of registering
the trix-editor and trix-toolbar custom elements, and the UMD build does
that via its globalThis branch. No bindings are imported from the
module, and Trix styling remains app-owned in
app/assets/stylesheets/actiontext.css.
Security fix for 3 stored/DOM XSS advisories in Trix:
GHSA-g9jg-w8vm-g96v (attachment attribute), GHSA-qmpg-8xg6-ph5q
(serialized attributes), GHSA-53p3-c7vp-4mcc (JSON deserialization
bypass in drag-and-drop).
EXPOSED: campfire's composer/editor use Trix for message bodies, and the
browser actually ran the hand-vendored vendor/javascript/trix.esm.min.js
pinned at 2.0.10 — which lacks the DOMPurify/isValidAttribute sanitizers.
The gem bump alone is a no-op for the browser; the real fix is
re-vendoring the ESM build:
- bump gem to 2.1.19 (Gemfile.lock)
- re-vendor vendor/javascript/trix.esm.min.js from Trix 2.1.19
(2.0.10 → 2.1.19; bundles DOMPurify 3.4.2, rangy 1.3.2)
- update importmap pin comment @2.0.10 → @2.1.19
89 commits analyzed. Verified green via full unit + system suites
(system tests drive the Trix composer via fill_in_rich_text_area).
https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-action_text-trix_v2.1.15..v2.1.19.md🤖 Assisted by Claude
Jeremy Daer
Mike Dalessio
Kevin McConnell