fix(deps): bump dompurify from 3.4.12 to 3.4.13

[dependabot]

Bumps dompurify from 3.4.12 to 3.4.13.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

Commits

• 3067f77 release: 3.4.13 (#1562)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[netlify]

✅ Deploy Preview for phillips-seldon ready!

Name	Link
🔨 Latest commit	f04653c
🔍 Latest deploy log	https://app.netlify.com/projects/phillips-seldon/deploys/6a7895b4c6a025000736fc43
😎 Deploy Preview	https://deploy-preview-916--phillips-seldon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[davidicus]

@dependabot squash and merge

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates the dompurify dependency to a newer patch version.

Changes:

• Bump dompurify from ^3.4.12 to ^3.4.13.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[phillips-pr-review-agent]

Review: dompurify 3.4.12 → 3.4.13

This is a straightforward Dependabot patch bump with no application-code changes. I would approve this.

What changed

• package.json range pin: ^3.4.12 → ^3.4.13
• package-lock.json resolved version, registry URL, and integrity hash updated accordingly — all three are internally consistent and only touch the dompurify entry.

Security relevance

This release is directly relevant to this codebase. dompurify is used for sanitizing raw HTML (paired with html-react-parser) and three security-adjacent fixes are included:

1. DOM clobbering via ownerDocument during IN_PLACE sanitization — highest relevance; any call-sites using DOMPurify.sanitize(…, { IN_PLACE: true }) or hooks alongside IN_PLACE were potentially bypassable.
2. Hooks bypassing the clone guard — relevant wherever custom addHook callbacks are registered.
3. Hook removal during IN_PLACE sanitization — correctness fix for removeHook/removeAllHooks.

Given that dompurify is the primary XSS mitigation layer in this package, picking up these fixes promptly is the right call. No API surface changed (patch release), so no consumer-side changes are needed.

Verdict

Safe to merge. No concerns.

[chromatic-com]

Tip

All tests passed and all changes approved!

🟢 UI Tests: 494 tests unchanged
🟢 UI Review: 247 stories published -- no changes
Storybook Publish: 247 stories published

[github-actions]

🚀 Storybook preview is ready.

• Preview: https://68b9f094608b90f3cfec5a06-ycnxxofugl.chromatic.com/
• Chromatic build: https://www.chromatic.com/build?appId=68b9f094608b90f3cfec5a06&number=698

[scottdickerson]

Dependency Upgrade Risk Assessment: dependency-upgrade-risk:low

What is DOMPurify and how is it used here?

DOMPurify is an HTML sanitization library that strips potentially malicious markup (XSS vectors, unsafe attributes, etc.) from HTML strings before they are injected into the DOM. It is one of the most widely-used sanitizers in the JavaScript ecosystem.

In the Seldon codebase, DOMPurify is listed as a runtime dependency in package.json (not devDependencies), meaning it is bundled into the library that ships to consumers such as phillips-public-remix, cms, and phoenix-admin. Every component downstream that renders user-provided or CMS-originated HTML strings relies on it indirectly through Seldon's build output. While the exact source file import wasn't surfaced by GitHub code search (search indexing lag), its presence as a production dependency confirms it is actively used for sanitizing HTML within one or more Seldon components.

---

Release Notes Summary (3.4.12 → 3.4.13)

• Fixed an issue with hook removal during IN_PLACE sanitization
• Fixed an issue with hooks potentially bypassing the clone guard
• Fixed DOM clobbering via ownerDocument during IN_PLACE sanitization
• Bumped several internal dependencies

This is a pure bug-fix patch release with no API changes and no new features.

---

Risk Rationale

Rating: LOW

• Patch bump only — no breaking changes, no API surface changes
• All three fixes are scoped to edge-case behaviour in IN_PLACE sanitization mode and custom sanitization hooks. If Seldon's usage does not rely on IN_PLACE mode or custom hooks, these changes are effectively no-ops at runtime
• High Dependabot compatibility score — confirmed in the PR badge
• DOMPurify has a strong track record of patch releases being safe to apply
• The change is small (5 additions, 5 deletions across 2 files — package.json + lock file)

The main consideration is that DOMPurify sits on the critical path for any component that renders untrusted HTML. That raises the importance of testing, even though the code change itself is minimal. This is why regression tests below should be checked before merging.

---

Regression Test Checklist

Before merging, confirm the following:

• Storybook smoke test — run npm run storybook and visually verify all components that accept and render HTML content (e.g. rich-text / banner / notification components) display correctly with no sanitization errors
• Seldon unit test suite passes — run npm run test and confirm no DOMPurify-related failures
• Chromatic visual regression — confirm no unexpected visual diffs in Chromatic CI output for HTML-rendering components
• Rich HTML content round-trip — manually test any component that uses dangerouslySetInnerHTML or sanitized HTML props with a realistic HTML payload from the CMS (including links, bold/italic, lists) and confirm output is unchanged
• IN_PLACE sanitization path (if used) — if any Seldon component calls DOMPurify with the IN_PLACE: true option, exercise that code path to confirm the hook-removal fix does not alter sanitization output
• Custom hooks (if used) — if any Seldon component registers a custom DOMPurify addHook handler, verify hook behaviour is unchanged after the upgrade

---

Generated by Claude Code