build(deps): bump dompurify from 3.3.1 to 3.4.0 in /frontend

[dependabot]

Bumps dompurify from 3.3.1 to 3.4.0.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

• Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
• Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
• Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
• Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
• Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
• Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
• Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth
• Fixed an issue with USE_PROFILES prototype pollution, thanks @​christos-eth
• Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @​researchatfluidattacks and others
• Fixed an issue with closing tags leading to possible mXSS, thanks @​frevadiscor
• Fixed a problem with the type dentition patcher after Node version bump
• Fixed freezing BS runs by reducing the tested browsers array
• Bumped several dependencies where possible
• Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

DOMPurify 3.3.3

• Fixed an engine requirement for Node 20 which caused hiccups, thanks @​Rotzbua

DOMPurify 3.3.2

• Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
• Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
• Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
• Bumped and removed several dependencies, thanks @​Rotzbua
• Fixed the test suite after bumping dependencies, thanks @​Rotzbua

Commits

• 5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
• 8bcbf73 chore: Preparing 3.3.3 release
• 5faddd6 fix: engine requirement (#1210)
• 0f91e3a Update README.md
• d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
• c3efd48 fix: moved back from jsdom 28 to jsdom 20
• 988b888 fix: moved back from jsdom 28 to jsdom 20
• 2726c74 chore: Preparing 3.3.2 release
• 6202c7e build(deps): bump @​tootallnate/once and jsdom (#1204)
• 302b51d fix: Expanded the regex ever so slightly to also cover script
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

Bumps dompurify from 3.3.1 to 3.4.0 in frontend/package.json and package-lock.json. This picks up three intermediate patch releases (3.3.2, 3.3.3) plus the 3.4.0 minor, which together address prototype pollution via CUSTOM_ELEMENT_HANDLING and USE_PROFILES, two mXSS paths (re-contextualization and malformed closing tags), ADD_ATTR predicate URI-validation bypass, and a missing SAFE_FOR_TEMPLATES scrub in the RETURN_DOM path — all directly relevant to the DOMPurify.sanitize() call in frontend/src/lib/services/markdown.ts.

Confidence Score: 5/5

Safe to merge — pure dependency bump that patches known security vulnerabilities with no logic changes.

Only two files changed (package.json and package-lock.json), both exclusively version and integrity-hash updates. The 3.4.0 release resolves multiple published security advisories directly relevant to this codebase's use of DOMPurify. No new APIs or behavior changes are introduced that would require code updates.

No files require special attention.

Important Files Changed

Filename	Overview
frontend/package.json	Bumps dompurify dependency from ^3.3.1 to ^3.4.0, picking up multiple security fixes including prototype pollution and mXSS patches.
frontend/package-lock.json	Lock file updated to pin dompurify at 3.4.0 with a new integrity hash; no other dependency changes.

Sequence Diagram

sequenceDiagram
    participant Browser
    participant MarkdownService as markdown.ts
    participant DOMPurify as DOMPurify 3.4.0
    participant Component as Svelte Component

    Browser->>MarkdownService: raw markdown string
    MarkdownService->>MarkdownService: marked.parse() → rawHtml
    MarkdownService->>DOMPurify: sanitize(rawHtml, options)
    Note over DOMPurify: Prototype pollution fixes<br/>mXSS re-contextualization fixes<br/>URI validation for ADD_ATTR
    DOMPurify-->>MarkdownService: sanitized HTML string
    MarkdownService-->>Component: safe HTML
    Component->>Browser: {@html safeHtml}

Loading

_{Reviews (1): Last reviewed commit: "build(deps): bump dompurify from 3.3.1 t..." | Re-trigger Greptile}

[dependabot]

Superseded by #50.