chore(deps): bump dompurify from 3.4.1 to 3.4.16 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: dompurify.

Updates dompurify from 3.4.1 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

... (truncated)

Commits

• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	testdocs	d1a6c3d	Commit Preview URL Branch Preview URL	Oct 06 2026, 09:32 AM

[claude]

Claude finished @dependabot[bot]'s task in 1m 35s —— View job

---

Review: dompurify 3.4.1 → 3.4.16 (dependabot)

• Gather context (PR diff, changed files)
• Review using skills/review-changes/SKILL.md checklist
• Post findings

Summary

This PR only touches pnpm-lock.yaml (+32/-10) — no application source changes. dompurify is a transitive dependency pulled in via mermaid; it does not appear anywhere in this repo's own source files.

Checked:

• Correctness / cross-file impact: nothing to review — no call sites or logic changed, only lockfile metadata.
• Simplification / reuse / efficiency: not applicable to a lockfile-only diff.
• Lockfile consistency: the incidental churn (new deprecated: annotations on @yuku-codegen/@yuku-parser, reshaped @vitest/browser-preview peer-dependency resolution key for [email protected]) is normal pnpm metadata recomputation, not a functional change. No stale/orphaned references remain.
• Commit type: chore(deps): bump dompurify correctly uses chore per this repo's CLAUDE.md rule (indirect dependency bump, no observable change for consumers of the published package).

No issues found. This dependency bump is safe to merge as-is.

[dependabot]

Superseded by #9.