build(deps): bump dompurify from 3.3.1 to 3.3.2

[dependabot]

Bumps dompurify from 3.3.1 to 3.3.2.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.2

• Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
• Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
• Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
• Bumped and removed several dependencies, thanks @​Rotzbua
• Fixed the test suite after bumping dependencies, thanks @​Rotzbua

Commits

• 5e56114 Getting 3.x branch ready for 3.3.2 release (#1208)
• e8c95f4 fix: Fixed the broken package-lock.json
• 9636037 Update package-lock.json
• 5cad4ce Getting 3.x branch ready for 3.3.2 releas (#1205)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

Greptile Summary

This is a Dependabot-generated security patch bump of dompurify from 3.3.1 to 3.3.2, addressing three security/correctness fixes upstream. The changes are confined to package.json and package-lock.json.

Key changes:

• package.json: Version specifier updated from ^3.2.5 → ^3.3.2, ensuring the patched version is always resolved and older vulnerable versions are excluded.
• package-lock.json: Resolved version updated to 3.3.2 with a new integrity hash; the upstream package now declares "engines": { "node": ">=20" }, which is consistent with the project's existing "@types/node": "^20.0" dependency.

Security fixes included in 3.3.2:

• Fixed a possible XSS bypass caused by jsdom's faulty raw-text tag parsing.
• Fixed a prototype pollution issue when working with custom elements.
• Fixed lenient config parsing in _isValidAttribute.

No application code was modified. The Node.js >=20 engine constraint introduced by the new dompurify version is already satisfied by the project's existing toolchain requirements.

Confidence Score: 5/5

• This PR is safe to merge — it is a patch-level security fix with no breaking changes.
• The change is a minor patch bump (3.3.1 → 3.3.2) of a well-known sanitisation library, fixing security issues with no API changes. The new Node.js >=20 engine requirement in the upstream package is already satisfied by the project's declared toolchain. No application code is modified.
• No files require special attention.

Important Files Changed

Filename	Overview
package.json	Updates dompurify minimum version specifier from ^3.2.5 to ^3.3.2, ensuring the security-patched version is always resolved.
package-lock.json	Locks dompurify to 3.3.2 with updated integrity hash; also adds a new "engines": { "node": ">=20" } constraint from the upstream package, which should be compatible given the project already targets Node.js 20.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["aw-webui"] -->|"depends on"| B["dompurify 3.3.2"]
    B -->|"optionalDependency"| C["@types/trusted-types ^2.0.7"]
    B -->|"engine requirement"| D["Node.js >= 20"]
    A -->|"already requires"| E["@types/node ^20.0"]
    D -.->|"compatible with"| E

    subgraph fixes["Fixes in 3.3.2"]
        F["jsdom raw-text tag bypass fix"]
        G["Prototype pollution fix"]
        H["Lenient config parsing fix"]
    end

    B --> fixes

Loading

_{Last reviewed commit: e754fa3}