From 8a9bcffaa23583549200ac33589fa4fa985b4e92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 22 Oct 2026 21:16:31 +0200
Subject: [PATCH] build(deps): raise the dompurify floor to 3.4.17

GHSA-cg2g-xh64-v4q7 (critical, a SAFE_FOR_TEMPLATES bypass) and GHSA-mrv2-3pqr-j5jr (high, an IN_PLACE hook that removes a parent) cover dompurify up to 3.4.16, which jspdf and jspdf-autotable pull in. jspdf 4.2.1 is the newest release and still allows that range, so the existing override moves its floor. The doctor-report PDF renders as before (unit and integration suites).
---
 pnpm-lock.yaml      | 10 +++++-----
 pnpm-workspace.yaml |  7 +++++--
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b50e04dd7..653737a0f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,7 +9,7 @@ overrides:
   hono@<4.13.11: ^4.13.11
   baseline-browser-mapping@<2.11.0: ^2.11.0
   sharp@<0.35.4: ^0.35.4
-  dompurify@<3.4.16: ^3.4.16
+  dompurify@<3.4.17: ^3.4.17
   postcss@<8.5.23: ^8.5.23
   nanoid@<3.3.18: ^3.3.18
   '@hono/node-server@<1.19.15': ^1.19.15
@@ -4163,8 +4163,8 @@ packages:
     resolution: {integrity: sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==}
     engines: {node: '>=0.10.0'}
 
-  dompurify@3.4.16:
-    resolution: {integrity: sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==}
+  dompurify@3.4.17:
+    resolution: {integrity: sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==}
 
   dot-prop@6.0.1:
     resolution: {integrity: sha512-tE7ztYzXHIeyvc7N+hR3oi7FIbf/NIjVP9hmAt3yMXzrQ072/fpjGLx2GxNxGxUl5V73MEqYzioOMoVhGMJ5cA==}
@@ -11305,7 +11305,7 @@ snapshots:
     dependencies:
       esutils: 2.0.3
 
-  dompurify@3.4.16:
+  dompurify@3.4.17:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
     optional: true
@@ -12429,7 +12429,7 @@ snapshots:
     optionalDependencies:
       canvg: 3.0.11
       core-js: 3.49.0
-      dompurify: 3.4.16
+      dompurify: 3.4.17
       html2canvas: 1.4.1
 
   jsx-ast-utils@3.3.5:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 5d93cae2c..2f95c35f1 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -12,8 +12,11 @@ overrides:
   # GHSA-55q2-fjhq-7xh7: a crafted document gets past the sanitiser and its
   # markup survives into the output. The copy here is jspdf's optional HTML
   # renderer, which the doctor-report PDF path reaches.
-  # A later advisory against 3.4.13 to 3.4.15 raised the floor to 3.4.16.
-  "dompurify@<3.4.16": "^3.4.16"
+  # A later advisory against 3.4.13 to 3.4.15 raised the floor to 3.4.16, and
+  # GHSA-cg2g-xh64-v4q7 (a SAFE_FOR_TEMPLATES bypass) with GHSA-mrv2-3pqr-j5jr
+  # (an IN_PLACE hook that removes a parent) to 3.4.17. jspdf 4.2.1, the
+  # newest release, still allows the flagged range.
+  "dompurify@<3.4.17": "^3.4.17"
   # CVE-2026-69153. Next declares an exact `postcss@8.4.31`, so nothing except
   # this bound moves it. The build has run on the 8.5 line since the first
   # bump; the fix landed in 8.5.23.