chore(deps): bump dompurify to 3.4.13 to resolve XSS CVEs BED-9194

[elikmiller]

Summary

Resolves BED-9194 by bumping dompurify to a patched release.

A BurpSuite DAST scan flagged dompurify 3.3.3 as a vulnerable JavaScript library. This PR upgrades to dompurify 3.4.13, which resolves the reported CVEs and all subsequent dompurify advisories.

CVEs resolved

• CVE-2026-41238 (GHSA-v9jr-rg53-9pgp) — Prototype pollution to XSS bypass via CUSTOM_ELEMENT_HANDLING fallback
• CVE-2026-41239 (GHSA-crv5-9vww-q3g8) — SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
• CVE-2026-65903 / CVE-2026-41240 (GHSA-39q2-94rc-95cp) — ADD_TAGS function form bypasses FORBID_TAGS

All three are fixed in dompurify 3.4.0; going to 3.4.13 additionally clears several moderate advisories introduced in 3.4.1–3.4.12.

Changes

• package.json: dompurify resolution 3.2.4 → 3.4.13
• packages/javascript/bh-shared-ui/package.json: dompurify dependency ^3.3.3 → ^3.4.0
• yarn.lock + committed Yarn offline cache refreshed to 3.4.13

Testing

• yarn install succeeds; lockfile resolves dompurify 3.4.13
• yarn npm audit (production): no remaining dompurify advisories
• Both UI apps build and type-check cleanly

---

Co-authored by Augment Code

Summary by CodeRabbit

• Bug Fixes
  • Improved protection and reliability when handling rendered content.
  • Updated content-sanitization behavior to address potential security and compatibility issues.
  • Reduced the risk of unsafe content being displayed in supported interfaces.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 80b946c2-7a05-441a-b66e-689d8f9f299a

📥 Commits

Reviewing files that changed from the base of the PR and between 214d4ca and 668edf8.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• packages/javascript/bh-shared-ui/package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/javascript/bh-shared-ui/package.json

---

📝 Walkthrough

Walkthrough

The pull request updates the dompurify version in the root resolution and the shared UI package dependency declaration.

Changes

DOMPurify dependency updates

Layer / File(s)	Summary
Update DOMPurify manifest versions package.json, packages/javascript/bh-shared-ui/package.json	The root dompurify resolution changed to 3.4.13. The shared UI dependency changed to ^3.4.13.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: dependencies, javascript

Suggested reviewers: maffkipp

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency update, target version, security purpose, and associated ticket.
Description check	✅ Passed	The description explains the security issue, affected advisories, changed files, ticket, and validation steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch BED-9194

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/javascript/bh-shared-ui/package.json`:
- Line 34: Update the dompurify dependency declaration in the bh-shared-ui
package manifest from ^3.4.0 to ^3.4.13, ensuring this workspace directly
requires the patched minimum version.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: f13ff5b1-7b4b-4eb1-b74c-01352fbd55f0

📥 Commits

Reviewing files that changed from the base of the PR and between b83320a and 214d4ca.

⛔ Files ignored due to path filters (3)

• .yarn/cache/dompurify-npm-3.2.4-d8ea6c7c6a-98570c5338.zip is excluded by !**/.yarn/**, !**/*.zip
• .yarn/cache/dompurify-npm-3.4.13-71386e31f7-0db0a309a8.zip is excluded by !**/.yarn/**, !**/*.zip
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• package.json
• packages/javascript/bh-shared-ui/package.json