chore(ui): update dependency dompurify to v3.4.12 [security]

2026-08-19 09:30:21 +00:00 · 2026-08-08 19:08:11 +00:00
1 changed files with 4 additions and 4 deletions
@@ -1,6 +1,3 @@
-# pnpm 11+ workspace config. .npmrc is auth/registry only; everything else lives here.
-# Reference: https://pnpm.io/supply-chain-security
-
 packages: []

 # Refuse to install on Node/pnpm outside the `engines` block in package.json.
@@ -75,7 +72,7 @@ overrides:
  # GHSA-vxr8-fq34-vvx9 (+ several related XSS sanitization bypasses): DOMPurify < 3.4.9,
  # pulled in transitively via streamdown > mermaid (which wants ^3.3.1). Bumped to 3.4.11
  # for GHSA-cmwh-pvxp-8882 (permanent ALLOWED_ATTR pollution via setConfig()).
-  "dompurify": "3.4.11"
+  "dompurify": "3.4.12"

 # --- Level 1: Minimum Release Age ---
 # Packages must be published for at least 1 day before they can be installed.
@@ -121,3 +118,6 @@ trustPolicyExclude:

 # Block transitive dependencies from using exotic specifiers (git URLs, tarballs).
 blockExoticSubdeps: true
+minimumReleaseAgeExclude:
+  # Renovate security update: dompurify@3.4.12
+  - dompurify@3.4.12