From c6e231362dbe533830732b251950c48fa04c90b4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 4 Nov 2026 11:39:25 +0000
Subject: [PATCH] fix(security): bump dompurify to patch XSS vulnerabilities

DOMPurify versions up to 3.4.16 had multiple disclosed sanitizer-bypass
XSS vulnerabilities, all fixed in 3.4.17. Bump the pinned dependency
range from ^3.4.16 to ^3.4.17 and update the lockfile accordingly.

The sanitize() API used in src/visualBuilder/utils/collabUtils.ts is
unchanged by this patch release.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 package-lock.json | 38 ++++----------------------------------
 package.json      |  2 +-
 2 files changed, 5 insertions(+), 35 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 5262bbb4..b5069903 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15,7 +15,7 @@
                 "classnames": "^2.5.1",
                 "dayjs": "^1.11.13",
                 "deepsignal": "^1.5.0",
-                "dompurify": "^3.4.16",
+                "dompurify": "^3.4.17",
                 "get-xpath": "^3.2.0",
                 "goober": "^2.1.16",
                 "lodash-es": "^4.18.1",
@@ -1655,9 +1655,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1675,9 +1672,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1695,9 +1689,6 @@
                 "ppc64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1715,9 +1706,6 @@
                 "s390x"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1735,9 +1723,6 @@
                 "x64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -1755,9 +1740,6 @@
                 "x64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MIT",
             "optional": true,
             "os": [
@@ -3971,9 +3953,9 @@
             "dev": true
         },
         "node_modules/dompurify": {
-            "version": "3.4.16",
-            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz",
-            "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==",
+            "version": "3.4.17",
+            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz",
+            "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==",
             "license": "(MPL-2.0 OR Apache-2.0)",
             "optionalDependencies": {
                 "@types/trusted-types": "^2.0.7"
@@ -6256,9 +6238,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -6280,9 +6259,6 @@
                 "arm64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -6304,9 +6280,6 @@
                 "x64"
             ],
             "dev": true,
-            "libc": [
-                "glibc"
-            ],
             "license": "MPL-2.0",
             "optional": true,
             "os": [
@@ -6328,9 +6301,6 @@
                 "x64"
             ],
             "dev": true,
-            "libc": [
-                "musl"
-            ],
             "license": "MPL-2.0",
             "optional": true,
             "os": [
diff --git a/package.json b/package.json
index f68bb52e..f4192418 100644
--- a/package.json
+++ b/package.json
@@ -92,7 +92,7 @@
         "classnames": "^2.5.1",
         "dayjs": "^1.11.13",
         "deepsignal": "^1.5.0",
-        "dompurify": "^3.4.16",
+        "dompurify": "^3.4.17",
         "get-xpath": "^3.2.0",
         "goober": "^2.1.16",
         "lodash-es": "^4.18.1",