From eb53cc995575b73a2ed9c7c72a25e5ae4f3f81ad Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 3 Oct 2026 03:40:47 +0000 Subject: [PATCH] fix(security): bump dompurify to patch DOM XSS advisory Bumps dompurify from 3.4.13/3.4.14 to 3.4.16 (direct dependency) in package.json and package-lock.json, resolving a Snyk-reported Cross-site Scripting (XSS) advisory in dompurify. Co-Authored-By: Claude --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index dd9fb017..ccfdad68 100644 --- a/package-lock.json +++ b/package-lock.json @@ -15,7 +15,7 @@ "classnames": "^2.5.1", "dayjs": "^1.11.13", "deepsignal": "^1.5.0", - "dompurify": "^3.4.13", + "dompurify": "^3.4.16", "get-xpath": "^3.2.0", "goober": "^2.1.16", "lodash-es": "^4.18.1", @@ -3971,9 +3971,9 @@ "dev": true }, "node_modules/dompurify": { - "version": "3.4.14", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.14.tgz", - "integrity": "sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==", + "version": "3.4.16", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz", + "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" diff --git a/package.json b/package.json index d3ab86cd..257aa09d 100644 --- a/package.json +++ b/package.json @@ -92,7 +92,7 @@ "classnames": "^2.5.1", "dayjs": "^1.11.13", "deepsignal": "^1.5.0", - "dompurify": "^3.4.13", + "dompurify": "^3.4.16", "get-xpath": "^3.2.0", "goober": "^2.1.16", "lodash-es": "^4.18.1",