[Cycode] Fix for vulnerable manifest file dependency - dompurify updated to version 3.4.0

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
ui/app/package.json	1

📂 ui/app/package.json

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
dompurify	3.2.4	3.4.0

Warning

Lock file generation failed for one or more manifest files in this pull request. Please regenerate the lock file manually before merging.

---

Note

Low Risk
Low risk dependency-only change updating dompurify to address a known vulnerability; potential impact is limited to any runtime behavior differences in HTML sanitization.

Overview
Updates the UI app’s dompurify dependency from ^3.2.4 to ^3.4.0 in ui/app/package.json to remediate a vulnerable package version.

^{Reviewed by Cursor Bugbot for commit 7aefde6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7aefde6. Configure here.}

[cursor]

Lock file not updated, vulnerable version still installed

High Severity

The package.json now requires dompurify ^3.4.0, but ui/package-lock.json still references and resolves version 3.2.4. Since npm ci (commonly used in CI/CD) installs from the lock file, the vulnerable version will continue to be installed in production. The security fix this PR intends to deliver won't actually take effect until the lock file is regenerated.

 

^{Reviewed by Cursor Bugbot for commit 7aefde6. Configure here.}