chore: upgrade dompurify to ^3.4.11 to address GHSA-x4vx-rjvf-j5p4

[brendan-kellam]

Fixes SOU-1356

Addresses GHSA-x4vx-rjvf-j5p4 (DOMPurify IN_PLACE mode trusts attacker-controlled nodeName on live non-form nodes). The advisory affects dompurify <= 3.4.6; dompurify reaches us transitively via posthog-js, whose ^3.3.2 range already admits the patched releases, so this is just a stale-lockfile refresh (yarn up -R dompurify) bumping the resolved version from 3.4.0 to 3.4.11. No package.json or resolutions changes needed.

Verified with yarn why dompurify --recursive that the only resolution is now 3.4.11.

Summary by CodeRabbit

• Bug Fixes
  • Updated dompurify to version 3.4.11 for enhanced security.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0b9858f1-3578-4c60-9aca-c38da9753ba2

📥 Commits

Reviewing files that changed from the base of the PR and between d2f291f and 78e9c67.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• CHANGELOG.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch linear/sou-1356-sourcebot-devsourcebot-ghsa-x4vx-rjvf-j5p4-dompurify-637c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2136
Resolved (non-standard)	20
Unresolved	0
Strong copyleft	0
Weak copyleft	38

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-darwin-arm64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.0.5	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.2.4	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.0.4	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.2.4	LGPL-3.0-or-later
@img/sharp-wasm32	0.33.5	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-wasm32	0.34.5	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.34.5	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.33.5	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.34.5	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.33.5	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.34.5	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (20)

Package	Version	Original	Resolved	Source
pause-stream	0.0.11	MIT,Apache2	(MIT OR Apache-2.0)	extracted from object (npm registry license array ["MIT","Apache2"])
@react-grab/cli	0.1.23	UNKNOWN	MIT	GitHub repo aidenybai/react-grab LICENSE (MIT)
@react-grab/cli	0.1.29	UNKNOWN	MIT	GitHub repo aidenybai/react-grab LICENSE (MIT)
@react-grab/mcp	0.1.29	UNKNOWN	MIT	GitHub repo aidenybai/react-grab LICENSE (MIT)
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	npm registry (license field = Apache-2.0)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	npm registry (license field = Apache-2.0)
element-source	0.0.3	UNKNOWN	MIT	GitHub repo aidenybai/element-source LICENSE (MIT)
map-stream	0.1.0	UNKNOWN	MIT	npm registry (license field = MIT)
memorystream	0.3.1	UNKNOWN	MIT	npm registry (licenses array [{type:MIT}])
valid-url	1.0.9	UNKNOWN	MIT	GitHub repo ogt/valid-url LICENSE (MIT)
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	GitHub repo PostHog/posthog-js LICENSE file (Apache-2.0 root license)
@sentry/cli	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry; FSL-1.1-MIT = Functional Source License 1.1 with MIT future grant (source-available, converts to MIT after 2 years; not copyleft)
@sentry/cli-darwin	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry; FSL-1.1-MIT = Functional Source License 1.1 with MIT future grant (source-available, converts to MIT after 2 years; not copyleft)
@sentry/cli-linux-arm	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry; FSL-1.1-MIT = Functional Source License 1.1 with MIT future grant (source-available, converts to MIT after 2 years; not copyleft)
@sentry/cli-linux-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry; FSL-1.1-MIT = Functional Source License 1.1 with MIT future grant (source-available, converts to MIT after 2 years; not copyleft)
@sentry/cli-linux-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry; FSL-1.1-MIT = Functional Source License 1.1 with MIT future grant (source-available, converts to MIT after 2 years; not copyleft)
@sentry/cli-linux-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry; FSL-1.1-MIT = Functional Source License 1.1 with MIT future grant (source-available, converts to MIT after 2 years; not copyleft)
@sentry/cli-win32-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry; FSL-1.1-MIT = Functional Source License 1.1 with MIT future grant (source-available, converts to MIT after 2 years; not copyleft)
@sentry/cli-win32-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry; FSL-1.1-MIT = Functional Source License 1.1 with MIT future grant (source-available, converts to MIT after 2 years; not copyleft)
@sentry/cli-win32-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry; FSL-1.1-MIT = Functional Source License 1.1 with MIT future grant (source-available, converts to MIT after 2 years; not copyleft)