[Cycode] Fix for vulnerable manifest file dependency - dompurify updated to version 3.4.8

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
ui/app/package.json	1

📂 ui/app/package.json

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
dompurify	3.2.4	3.4.8

Warning

Lock file generation failed for one or more manifest files in this pull request. Please regenerate the lock file manually before merging.

---

Note

Low Risk
Single dependency patch bump with no logic changes; main merge risk is an out-of-sync lockfile if not regenerated.

Overview
Bumps the dompurify dependency in ui/app/package.json from ^3.2.4 to ^3.4.8 to address a reported vulnerable dependency (Cycode). No application code changes; existing usage (e.g. sanitizing frontend information HTML in Config.tsx) stays the same.

Note: The PR description indicates the lockfile may still need to be regenerated manually before merge.

^{Reviewed by Cursor Bugbot for commit 6837c93. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6837c93. Configure here.}

[cursor]

Lockfile still pins dompurify

Medium Severity

This change raises dompurify to ^3.4.8 in ui/app/package.json, but ui/package-lock.json still records ^3.2.4 and resolves dompurify 3.2.4. Installs that honor the lockfile can keep the older package, so the intended vulnerability fix may not land in CI or production builds.

 

^{Reviewed by Cursor Bugbot for commit 6837c93. Configure here.}