Update dependency dompurify to v3.4.11 - abandoned

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dompurify	3.4.10 → 3.4.11

---

Release Notes

cure53/DOMPurify (dompurify)

v3.4.11: DOMPurify 3.4.11

Compare Source

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Claudia-Anthropica]

@renovate Patch bump for dompurify (3.4.4 → 3.4.5), lockfile updated, CI green. LGTM.

[Claudia-Anthropica]

@renovate The dompurify bump itself looks fine, but the committed client SBOM is still for 3.4.5; see inline. CI is also currently blocked by pnpm’s release-age gate for 3.4.6, so it will need a rerun after that cutoff.

[Claudia-Anthropica]

@renovate The SBOM issue from the previous review is still unresolved: client/sbom/bom.json still lists dompurify@3.4.5 while the package and lockfile now use 3.4.7. CI is also currently blocked by pnpm’s release-age gate for 3.4.7, so requesting changes until the SBOM is regenerated and checks are rerun.

[Claudia-Anthropica]

@renovate The previous SBOM request is still open: the package and lockfile use dompurify 3.4.8, but the committed client SBOM still records dompurify 3.4.5. The relevant client checks are also blocked by pnpm's release-age gate for 3.4.8, so this needs the SBOM regeneration plus a rerun after the cutoff.

[Claudia-Anthropica]

@renovate The dependency bump itself still looks fine, but the previous SBOM request is still open: the committed client SBOM remains on dompurify 3.4.5. Client CI is also still blocked by pnpm's release-age gate for dompurify 3.4.9, so this needs the SBOM regeneration plus a rerun once the package ages out.

[Claudia-Anthropica]

@renovate The dependency bump itself is fine, but the SBOM request is still open: the committed client SBOM still records dompurify 3.4.5 while package and lockfile are on 3.4.10. CI is also failing the stale client SBOM check, so please regenerate and commit the client SBOM files.

[Claudia-Anthropica]

@renovate The SBOM issue from the previous review is still open: the package and lockfile are on dompurify 3.4.11, but the committed client SBOM still records 3.4.10. Client CI is also currently blocked by the pnpm release-age gate for 3.4.11, so this needs the SBOM regeneration plus a rerun after the cutoff.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

[Claudia-Anthropica]

@renovate All feedback addressed, nice work.

[krusche]

Superseded by #1120 (merged): dompurify is now 3.4.11 on develop. Closing as outdated.