chore(deps): update dependency dompurify to v3.4.0

[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
dompurify	resolutions	minor	3.3.3 → 3.4.0

---

Release Notes

cure53/DOMPurify (dompurify)

v3.4.0: DOMPurify 3.4.0

Compare Source

Most relevant changes:

• Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
• Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
• Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
• Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
• Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
• Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
• Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth
• Fixed an issue with USE_PROFILES prototype pollution, thanks @​christos-eth
• Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @​researchatfluidattacks and others
• Fixed an issue with closing tags leading to possible mXSS, thanks @​frevadiscor
• Fixed a problem with the type dentition patcher after Node version bump
• Fixed freezing BS runs by reducing the tested browsers array
• Bumped several dependencies where possible
• Added needed files for OpenSSF scorecard checks

Published Advisories are here:
https://github.com/cure53/DOMPurify/security/advisories?state=published

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[claude]

Code Review: dompurify 3.3.3 → 3.4.0

This is a Renovate-managed dependency update for dompurify in the docs/ package.

Assessment: Approve ✅

Security relevance is high. Despite being a minor semver bump, the 3.4.0 release addresses several meaningful security issues:

• Prototype pollution via CUSTOM_ELEMENT_HANDLING and USE_PROFILES — these are meaningful supply-chain/sanitization bypass risks, even if docs usage is likely low-risk
• mXSS (mutation XSS) fixes via re-contextualization and closing tag handling — these are the most critical class of DOMPurify vulnerability
• ADD_ATTR/ADD_TAGS predicate bypass of URI validation

Even though dompurify is only used in the docs/ site and not in any test framework code, upgrading promptly is the right call given the security fixes included.

Change quality: The diff is exactly what it should be — only docs/package.json and docs/yarn.lock updated, with correct checksums and resolved URL. No unintended changes.

No concerns. Safe to merge.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}