[dependabot]

Bumps dompurify from 3.4.11 to 3.4.17.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

Commits

• a77a3e7 release: 3.4.17 (#1672)
• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Looks like dompurify is up-to-date now, so this is no longer needed.

[github-actions]

🤖 Codex-Style Code Review by OpenCode (Vue Best Practice Enabled)

💡 Autonomous AI Reviewer inspecting git commit history and Vue code quality.

Code Review Report — PR: build(deps): bump dompurify from 3.4.11 to 3.4.17

Head: cb91266 (merge of Dependabot commit cf1daee into 88701b6) · Base: origin/main (c282166)

---

PR Overview

Item	Detail
Type	Automated dependency bump (Dependabot)
Changed files	package-lock.json only (1 file, ±3 lines)
Dependency	dompurify 3.4.11 → 3.4.17
Dependency kind	Indirect (transitive via mermaid), not declared in package.json
Source code changes	None

The branch commit (cf1daee) only updates three lockfile fields for node_modules/dompurify: version, resolved, and integrity.

---

🔴 Critical Finding: The PR is a no-op

The merge commit's tree is byte-identical to its first parent 88701b6:

HEAD^{tree}     = 315a16c7f2cb8e6d13ee72bb3cc0291cc04f4bc0
88701b6^{tree}  = 315a16c7f2cb8e6d13ee72bb3cc0291cc04f4bc0   ← identical

git diff origin/main...HEAD produces no output — the effective diff against the merge base is empty.

Why: The base already absorbed this bump. PR #229 (88701b6, katex + mermaid bump) regenerated the lockfile, which pulled mermaid's transitive dompurify range from ^3.3.3 up to ^3.4.12 and resolved it to 3.4.17 — the exact version this PR targets:

// origin/main package-lock.json (already present)
"node_modules/dompurify": {
  "version": "3.4.17",   // ← already at target version on main
  ...
}

Dependabot opened this PR from a stale base (2de50fe) before #229 landed. Merging it changes nothing.

---

Assessment

✅ Correct

• Integrity hash and registry URL for 3.4.17 are legitimate.
• Bumping DOMPurify is security-relevant hygiene: mermaid relies on it to sanitize rendered diagram HTML used in src/views/Editor.vue and src/views/ExperimentSummary.vue. (No direct DOMPurify import exists in src/ — purely transitive.)

⚠️ Concerns

1. Redundant merge commit — merging this PR adds a permanent no-op merge commit (cb91266) to history, which can confuse git bisect runs and blame tooling for zero benefit.
2. Stale base — Dependabot's branch was cut from 2de50fe; it should be rebased/closed rather than merged.

Vue 3 / Code Quality

Not applicable — no .vue, .ts, or application code touched. No Composition API, reactivity, lifecycle, or typing concerns arise from this change.

---

Recommendation

Close this PR (reason: "already satisfied by #229"). origin/main already resolves dompurify@3.4.17; the lockfile on main is identical to what this PR would produce. No action needed on the dependency itself.

If the project prefers Dependabot PRs to be merged rather than closed, merging is technically harmless (clean merge, empty resulting diff), but it should not be squashed-with-title since the title would imply a bump that doesn't occur in the resulting tree.