build(deps): bump dompurify from 3.4.10 to 3.4.11

[dependabot]

Bumps dompurify from 3.4.10 to 3.4.11.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

Commits

• 0cae518 release: 3.4.11 (#1494)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

🤖 Codex-Style Code Review by OpenCode

💡 This is an automated advisory review. It is non-blocking and does not affect merge requirements.

Code Review: dompurify 3.4.10 → 3.4.11

File: package-lock.json (6 lines changed)

Overview

This diff updates the dompurify dependency from 3.4.10 to 3.4.11 in the lockfile. Since dompurify is an HTML sanitizer, it is a security-critical dependency — any update warrants scrutiny.

---

Analysis

Check	Verdict	Notes
Semver compatibility	✅	Patch bump (3.4.10 → 3.4.11) — expected to be backward-compatible
Integrity hash updated	✅	New SRI hash matches the new version tarball
License unchanged	✅	Still (MPL-2.0 OR Apache-2.0)
Optional deps unchanged	✅	@types/trusted-types dependency preserved
No cascading changes	✅	No other packages re-resolved

---

🔴 [blocking] Missing package.json change

The diff only touches package-lock.json — there is no corresponding package.json update in the diff. This means one of:

1. package.json was already at ^3.4.11 (e.g., it specified "dompurify": "^3.4.10" and npm install resolved to 3.4.11). In this case the lockfile sync is correct.
2. package.json still pins 3.4.10 — if so, this lockfile change is orphaned. Running npm ci would downgrade back to 3.4.10, or a subsequent npm install would overwrite this entry.

🔴 Action required: Verify that package.json specifies a version range compatible with 3.4.11 (e.g., ^3.4.10 or ^3.4.11). If it pins "3.4.10" exactly, the lockfile entry must match and this change is invalid.

---

🟡 [important] Verify the release notes

For a security library, patch bumps often include security fixes. I recommend checking the dompurify 3.4.11 release notes to confirm:

• Whether this addresses any CVEs
• Whether any breaking behavior changes were introduced (unlikely for a patch, but worth confirming for a sanitizer)

If this fixes a vulnerability, consider adding a comment in the commit message referencing the CVE.

---

🟢 [nit] Consider adding an upstream integrity check

For security-critical dependencies, some teams pin the integrity hash in package.json as an extra validation layer (e.g., using integrity field or an overrides block). This is optional but considered a security best practice for sanitizer libraries.

---

Summary

Severity	Count
🔴 Blocking	1 — Missing package.json verification
🟡 Important	1 — Verify release notes for security fixes
🟢 Nit	1 — Consider integrity pinning

Decision: 💬 Comment — The change itself (version bump + hash update) is mechanically correct for a patch update, but the missing package.json context must be confirmed before this can be approved.