From 61653e9697e667ebf4443bf7451b49306fd9fb18 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Wed, 21 Oct 2026 23:12:24 +0200
Subject: [PATCH] chore: bump DOMPurify to 3.4.17 (#32863)

The web UI still shipped version 3.4.11 of DOMPurify, the library that strips unsafe HTML before content is shown, six releases behind DOMPurify's own latest. This moves it to 3.4.17, and new installs now require at least that version.

Co-authored-by: wesyoung2022 <115102004+wesyoung2022@users.noreply.github.com>
---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index efd8c0656e..4f0c93b945 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -56,7 +56,7 @@
 				"crc-32": "^1.2.2",
 				"dayjs": "^1.11.10",
 				"docx-preview": "0.4.0",
-				"dompurify": "^3.2.6",
+				"dompurify": "^3.4.17",
 				"eventsource-parser": "^1.1.2",
 				"fast-deep-equal": "^3.1.3",
 				"file-saver": "^2.0.5",
@@ -7915,9 +7915,9 @@
 			}
 		},
 		"node_modules/dompurify": {
-			"version": "3.4.11",
-			"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz",
-			"integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==",
+			"version": "3.4.17",
+			"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz",
+			"integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==",
 			"license": "(MPL-2.0 OR Apache-2.0)",
 			"optionalDependencies": {
 				"@types/trusted-types": "^2.0.7"
diff --git a/package.json b/package.json
index e8968da511..2c85c45fd8 100644
--- a/package.json
+++ b/package.json
@@ -106,7 +106,7 @@
 		"crc-32": "^1.2.2",
 		"dayjs": "^1.11.10",
 		"docx-preview": "0.4.0",
-		"dompurify": "^3.2.6",
+		"dompurify": "^3.4.17",
 		"eventsource-parser": "^1.1.2",
 		"fast-deep-equal": "^3.1.3",
 		"file-saver": "^2.0.5",