chore(deps): bump dompurify from 3.4.0 to 3.4.9 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: dompurify.

Updates dompurify from 3.4.0 to 3.4.9

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

DOMPurify 3.4.7

• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
• Removed a problem leading to permanent hook pollution, thanks @​offset
• Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

• Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
• Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
• Added more test coverage for IN_PLACE and general DOM Clobbering attacks
• Bumped several dependencies where possible

DOMPurify 3.4.5

• Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @​KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

DOMPurify 3.4.4

• Added the selectedcontent element to default allow-list, thanks @​lukewarlow
• Added the command and commandfor attributes to default allowed-list, thanks @​lukewarlow
• Added better template scrubbing for IN_PLACE operations, thanks @​DEMON1A
• Added stronger checks for cross-realm windows, thanks @​DEMON1A & @​fg0x0
• Updated demo website and made sure it uses the latest from main
• Updated existing workflows, fuzzer, dependabot, etc., added more tests
• Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

DOMPurify 3.4.3

• Fixed an issue with handling of nested Shadow DOM trees, thanks @​fishjojo1
• Fixed the template regexes to be more robust against ReDoS attacks, thanks @​aleung27
• Updated the node iteration code to catch more Shadow DOM related issues
• Updated Playwright and added Node 26 to test matrix
• Updated existing workflows, fuzzer, release signing, etc., added more tests
• Bumped several dependencies where possible

DOMPurify 3.4.2

... (truncated)

Commits

• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• bb7739e release: 3.4.6 (#1394)
• 011b0c7 release: 3.4.5 (#1382)
• 5817ad9 release: 3.4.4 (#1374)
• 520edb0 release: 3.4.3 (#1352)
• 6f67fd3 Sync/3.4.2 (#1322)
• 5b0cdbb chore: merge main into 3.x for 3.4.1 release (#1301)
• 09f5911 test: added three more browsers to test setup (OSX, mobile)
• See full diff in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

Greptile Summary

This PR bumps dompurify from 3.4.0 to 3.4.9 in both apps/self-hosted and apps/web, incorporating several security-relevant patches. The pnpm-lock.yaml also reflects a collateral upgrade of postcss from 8.5.13 to 8.5.14.

• Security patches included: 3.4.5 fixed an XSS bypass introduced by the selectedcontent element (marked a security release); 3.4.6 fixed DOM Clobbering in IN_PLACE mode; 3.4.7–3.4.9 hardened Shadow DOM, Trusted Types, and template-scrubbing behavior.
• Collateral lock update: postcss 8.5.13 → 8.5.14 propagated through the lockfile as a peer-dependency re-resolution; no direct version constraints changed.

Confidence Score: 5/5

Straightforward security patch update from a well-maintained library; safe to merge.

The change is a pure version bump of dompurify incorporating multiple security and hardening patches, including a critical XSS bypass fix in 3.4.5. The lockfile changes are mechanical re-resolutions of peer dependencies (postcss 8.5.14). No application code was modified.

No files require special attention.

Important Files Changed

Filename	Overview
apps/self-hosted/package.json	Bumps dompurify specifier from ^3.4.0 to ^3.4.9; no other changes.
apps/web/package.json	Bumps dompurify specifier from ^3.4.0 to ^3.4.9; no other changes.
pnpm-lock.yaml	Lockfile updated to resolve dompurify@3.4.9 and postcss@8.5.14 (collateral peer-dep re-resolution); all snapshot hashes look consistent.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["dompurify 3.4.0"] --> B["3.4.1: Cross-realm window checks"]
    B --> C["3.4.2: Bug fixes"]
    C --> D["3.4.3: ReDoS fix in template regexes\nNested Shadow DOM fix"]
    D --> E["3.4.4: selectedcontent allowlist\n⚠️ Deprecated – XSS bypass"]
    E --> F["3.4.5 🔒 Security release\nFixed selectedcontent bypass"]
    F --> G["3.4.6: DOM Clobbering fixes\nin IN_PLACE mode"]
    G --> H["3.4.7: Shadow Root hardening\nHook pollution fix"]
    H --> I["3.4.8: Trusted Types policy fix\nNode iterator fix"]
    I --> J["dompurify 3.4.9 ✅\nTrusted Types + IN_PLACE improvements"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["dompurify 3.4.0"] --> B["3.4.1: Cross-realm window checks"]
    B --> C["3.4.2: Bug fixes"]
    C --> D["3.4.3: ReDoS fix in template regexes\nNested Shadow DOM fix"]
    D --> E["3.4.4: selectedcontent allowlist\n⚠️ Deprecated – XSS bypass"]
    E --> F["3.4.5 🔒 Security release\nFixed selectedcontent bypass"]
    F --> G["3.4.6: DOM Clobbering fixes\nin IN_PLACE mode"]
    G --> H["3.4.7: Shadow Root hardening\nHook pollution fix"]
    H --> I["3.4.8: Trusted Types policy fix\nNode iterator fix"]
    I --> J["dompurify 3.4.9 ✅\nTrusted Types + IN_PLACE improvements"]

Loading

_{Reviews (1): Last reviewed commit: "chore(deps): bump dompurify in the npm_a..." | Re-trigger Greptile}