build(deps): bump dompurify from 3.4.5 to 3.4.13

[dependabot]

Summary\n\n[Brief description of changes]\n\nBumps dompurify from 3.4.5 to 3.4.13.\n

\n

Release notes

\n

Sourced from dompurify's releases.

\n

\n

DOMPurify 3.4.13

\n

\n
• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
\n
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
\n
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
\n
• Bumped several dependencies where possible
\n

\n

DOMPurify 3.4.12

\n

\n
• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
\n
• Hardened the handling of hooks removing elements, @​mkrause-bee360
\n
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
\n
• Hardened the handling of declarative partial updates
\n
• Updated the documentation is several spots, README, wiki, etc.
\n
• Bumped several dependencies where possible
\n

\n

DOMPurify 3.4.11

\n

\n
• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
\n
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
\n
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
\n
• Updated up the linting tool-chain and removed now-redundant lint directives
\n
• Updated the documentation is several spots, README, wiki, etc.
\n
• Bumped several dependencies where possible
\n

\n

DOMPurify 3.4.10

\n

\n
• Refactored codebase for clarity: extracted the public type declarations into types.ts
\n
• Decomposed the three largest sanitizer functions into focused helpers
\n
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
\n
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
\n
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
\n
• Reduced CI cost by running the full three-engine browser suite once per PR
\n
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
\n
• Documented the bench and test:happydom scripts in the README
\n
• Completed the Attack Classes & Bypass History wiki page
\n
• Bumped several dependencies where possible
\n

\n

DOMPurify 3.4.9

\n

\n
• Further improved the handling of Trusted Types config options, thanks @​offset
\n
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
\n
• Added more test coverage for IN_PLACE and Trusted Types related usage
\n
• Bumped several dependencies where possible
\n
• Updated README and wiki with more accurate documentation & attack samples
\n

\n

DOMPurify 3.4.8

\n

\n
• Cleaned up the repository root, renamed some and removed unneeded files
\n
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
\n
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
\n
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
\n
• Bumped several dependencies where possible
\n

\n

DOMPurify 3.4.7

\n

\n
• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
\n

\n\n

\n

... (truncated)

\n

\n

\n

Commits

\n

\n
• 3067f77 release: 3.4.13 (#1562)
\n
• a9ca1e5 release: 3.4.12 (#1537)
\n
• 0cae518 release: 3.4.11 (#1494)
\n
• 6ee5716 release: 3.4.10 (#1478)
\n
• 5210247 release: 3.4.9 (#1459)
\n
• bcdd828 release: 3.4.8 (#1439)
\n
• ca30f07 release: 3.4.7 (#1414)
\n
• bb7739e release: 3.4.6 (#1394)
\n
• See full diff in compare view
\n

\n

\n
\n\n\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting .\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n

\n

Dependabot commands and options

\n
\n\nYou can trigger Dependabot actions by commenting on this PR:\n- will rebase this PR\n- will recreate this PR, overwriting any edits that have been made to it\n- will show all of the ignore conditions of the specified dependency\n- will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the Security Alerts page.\n\n

\n\n## Test plan\n\n- [ ] Manual testing complete\n- [ ] Automated tests pass\n- [ ] No regressions detected\n\n## Changelog\n\n### Added\n- \n\n### Changed\n- \n\n### Fixed\n-

Final Status

• Status: 🚫 Closed (not merged)
• Closed Date: 2026-08-18
• Latest Commit: 9d16865 - Merge branch 'develop' into dependabot/npm_and_yarn/dompurify-3.4.13

[ashleyshaw]

Closing to allow dependabot to recreate with fresh dependencies after recent develop changes. The branch validation exemption (PR #1933) is now live and will allow these to merge automatically.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[github-actions]

⏱️ Aging and SLA annotation

• Age: 5 day(s)
• SLA state: Within SLA
• Thresholds: warn at 7 days, breach at 14 days
• Last updated: 2026-08-18T12:45:26.173Z

Maintained by project-meta-sync workflow.