fix(deps): vuln dompurify (minor → 3.4.11) [ui/lib]

[gh-worker-campaigns-3e9aa4]

Summary: Security update — 1 package upgraded (MINOR changes included)

Manifests changed:

• ui/lib (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
dompurify	3.2.6	3.4.11	minor	Direct	16 MEDIUM, 3 LOW

---

Security Details

ℹ️ Other Vulnerabilities (19)

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
dompurify	GHSA-hpcv-96wg-7vj8	MODERATE	DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound instanceof checks	3.2.6	3.4.6	-
dompurify	CVE-2025-15599	MODERATE	-	3.2.6	-	-
dompurify	GHSA-39q2-94rc-95cp	MODERATE	DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation	3.2.6	3.4.0	-
dompurify	GHSA-crv5-9vww-q3g8	MODERATE	DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode	3.2.6	3.4.0	-
dompurify	GHSA-cjmm-f4jc-qw8r	MODERATE	DOMPurify ADD_ATTR predicate skips URI validation	3.2.6	3.3.2	-
dompurify	GHSA-cmwh-pvxp-8882	MODERATE	DOMPurify: Permanent ALLOWED_ATTR pollution via setConfig() bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)	3.2.6	3.4.11	-
dompurify	GHSA-rp9w-3fw7-7cwq	MODERATE	DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content	3.2.6	3.4.7	-	dompurify	GHSA-cj63-jhhr-wcxv	MODERATE	DOMPurify USE_PROFILES prototype pollution allows event handlers	3.2.6	3.3.2	-	dompurify	GHSA-h8r8-wccr-v5f2	MODERATE	DOMPurify is vulnerable to mutation-XSS via Re-Contextualization	3.2.6	3.3.2	-	dompurify	GHSA-r47g-fvhr-h676	MODERATE	DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM	3.2.6	3.4.6	-	dompurify	GHSA-v9jr-rg53-9pgp	MODERATE	DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback	3.2.6	3.4.0	-	dompurify	CVE-2026-0540	MODERATE	-	3.2.6	-	-	dompurify	GHSA-v8jm-5vwx-cfxm	MODERATE	DOMPurify contains a Cross-site Scripting vulnerability	3.2.6	3.2.7	-	dompurify	GHSA-h7mw-gpvr-xq4m	MODERATE	DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)	3.2.6	3.4.0	-	dompurify	GHSA-v2wj-7wpq-c8vv	MODERATE	DOMPurify contains a Cross-site Scripting vulnerability	3.2.6	3.3.2	-	dompurify	GHSA-76mc-f452-cxcm	MODERATE	DOMPurify: Hook mutation of data.allowedTags / data.allowedAttributes permanently pollutes DEFAULT_ALLOWED_TAGS / DEFAULT_ALLOWED_ATTR	3.2.6	3.4.7	-	dompurify	GHSA-vxr8-fq34-vvx9	LOW	DOMPurify: Trusted Types policy survives clearConfig() and can poison later RETURN_TRUSTED_TYPE output	3.2.6	3.4.9	-	dompurify	GHSA-x4vx-rjvf-j5p4	LOW	DOMPurify: IN_PLACE mode trusts attacker-controlled nodeName on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects	3.2.6	-	-	dompurify	GHSA-gvmj-g25r-r7wr	LOW	DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside content when using DOM output modes	3.2.6	3.4.8	-