#1145 fix(security): update DOMPurify and ip-address

User description

PR #1145 combines two narrowly scoped dependency security corrections discovered while clearing its all-lockfile OSV admission.

Changes

• Update the shipped DOMPurify dependency and workspace override to 3.4.17 / >=3.4.17 <4, including jsPDF's optional copy. Four focused sanitizer regressions cover the upstream XHTML/SVG, shadow-root template, and hook-detachment cases.
• Raise the ip-address workspace floor to >=10.7.4 <11 for GHSA-rxp7-6hxx-x8q5. On this branch, pnpm why traces it only through @lhci/cli developer tooling to socks; no first-party source reference was found. This is dependency-presence evidence, not a reproduced shipped-app exploit.

Local validation on d1db37b37ac3fc0a94983fd33c450781302afbda

• Pinned pnpm 12.13.0 frozen reconciliation and dependency-state verification passed.
• Focused DOMPurify and ip-address tests passed 6/6 on the preceding implementation commit; after the CodeScene refactor, the focused ip-address suite passed 2/2.
• docs:check, the complete local ci:prepush admission, and SSH signature verification passed.
• Current PR budget: 8 files / 176 meaningful lines / 6 commits.

Current exact-head evidence

• CI run 41027370593: enforced Security Audit / OSV failed at job 123968778411. It reports the same 29 records across 12 package versions and all three lockfiles (12 High, 14 Medium, 3 Low; 26 marked fixable). The patched ip-address advisory is absent; the stale GHSA-hp3w-g68c-fv3c ignore is still reported. The current package/advisory matrix and reachability evidence are tracked in #1146.
• The required CI Success job failed because Security Audit failed; downstream quality, Rust, build, and E2E jobs were skipped.
• CodeQL run 41027370559, text-attribution and changelog guards, CodeAnt quality checks, and all three CodeScene gates passed. The CodeScene complexity finding was refactored without suppression and its thread was resolved. No actionable inline thread is unresolved. CodeAnt reports its d1db review completed at 08:41; its quality checks passed and it left no new actionable inline finding. Codex review completed on d1db with no findings; the separate Codex security-review channel did not run. The earlier Sourcery override-bound and test-metric findings were addressed in b954 with reply receipts.
• The Vercel status says “Canceled by Ignored Build Step”; it does not establish a preview deployment.
• Do not merge while required security or CI checks are red or skipped. Exact-head run logs and the finding matrix are linked above. Generated summaries below may lag the latest gate evidence. Refs #1132 and #1146; the hardening window remains open.

Summary by Sourcery

Apply patched DOMPurify and ip-address dependency versions to address known security advisories while preserving compatibility and verifying the resulting dependency paths.

Bug Fixes:

• Update DOMPurify to 3.4.17 to address XHTML/SVG, shadow-root template, and detached-subtree sanitization vulnerabilities.
• Raise the ip-address dependency floor to 10.7.4 for the Lighthouse CI tooling vulnerability.

Documentation:

• Document the dependency security updates and refresh the README test-count metrics.

Tests:

• Add regression coverage for the DOMPurify fixes and assertions that the patched ip-address version remains confined to Lighthouse CI developer tooling.

Summary by cubic

Updates DOMPurify to 3.4.17 and raises the dev-only ip-address floor to 10.7.4, closing three DOM XSS advisories (GHSA-c6gr-qvv4-5v3f, GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr) and GHSA-rxp7-6hxx-x8q5.

• The dompurify override is capped <4 to keep the jsPDF 3.x contract; ip-address is bound >=10.7.4 <11 and reachable only via @lhci/cli → socks. The lockfile touches only the sanitizer, ip-address, and jsPDF's optional dompurify copy.
• Four DOMPurify regressions cover XHTML SVG href animation targets, shadow-root template scrubbing, and both hook-detached subtree paths; a simplified lockfile assertion pins the ip-address resolution.
• App call sites use string sanitization without these modes, so the DOMPurify tests qualify the dependency boundary rather than reproduce a production exploit.

Merge blocker: the OSV scan and full CI have not run on the updated head; do not merge while the security gate is unconfirmed.

Summary by CodeRabbit

• Security
  • Updated the HTML sanitization library to version 3.4.17, including the copy used by jsPDF.
  • Raised the Lighthouse CI tooling dependency to version 10.7.4 or later within the 10.x line.
• Tests
  • Added regression coverage for SVG links, templates in shadow roots, and event handlers on detached content.
  • Added checks to verify the updated tooling dependency is used in the lockfile.
• Documentation
  • Updated security notes, changelog details, and reported test totals.

CodeAnt-AI Description

Patch HTML sanitizer security issues and update Lighthouse CI networking dependency

What Changed

• Update the app and jsPDF’s HTML sanitizer to address unsafe SVG links, template expressions in shadow roots, and unsanitized content detached by hooks.
• Update Lighthouse CI’s networking dependency to a patched release.

Impact

✅ Unsafe SVG links removed during XHTML sanitization
✅ Malicious content neutralized when sanitizer hooks detach nodes
✅ Patched IP parsing in Lighthouse CI tooling

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review