[Cycode] Fix for vulnerable manifest file dependency - dompurify updated to version 3.4.13

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
ui/app/package.json	1

📂 ui/app/package.json

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
dompurify	3.2.4	3.4.13

Warning

Lock file generation failed for one or more manifest files in this pull request. Please regenerate the lock file manually before merging.

---

Note

Low Risk
Single dependency version bump in a manifest only; low risk though lockfile sync is needed before merge.

Overview
Bumps the dompurify dependency in ui/app/package.json from ^3.2.4 to ^3.4.13 to address a reported vulnerable dependency (Cycode).

No application code changes; existing usage (e.g. DOMPurify.sanitize on frontend information HTML) stays the same. The PR notes that lock file regeneration failed—package-lock.json may still pin 3.2.4 until updated manually before merge.

^{Reviewed by Cursor Bugbot for commit 0d96aef. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0d96aef. Configure here.}

[cursor]

Stale lockfile blocks security update

High Severity

dompurify was bumped to ^3.4.13 in package.json, but ui/package-lock.json still pins 3.2.4. CI runs npm ci, which fails when the lockfile does not satisfy the new range, and installs that use the lockfile keep the vulnerable version this PR aims to replace.

 

^{Reviewed by Cursor Bugbot for commit 0d96aef. Configure here.}