[dependabot]

Bumps dompurify to 3.4.17 and updates ancestor dependency swagger-ui-react. These dependencies need to be updated together.

Updates dompurify from 3.0.5 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

... (truncated)

Commits

• a77a3e7 release: 3.4.17 (#1672)
• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates swagger-ui-react from 5.7.2 to 5.33.3

Release notes

Sourced from swagger-ui-react's releases.

v5.33.3

5.33.3 (2026-10-15)

Bug Fixes

• deps: bump swagger-client to v3.38.3 (#11096) (f170383)

v5.33.2

5.33.2 (2026-10-12)

Bug Fixes

• deps: bump dompurify from 3.4.13 to 3.4.16 (#11076) (3beee55)
• json-schema-5: move early return after useCallback in models (#11082) (7f26236)

v5.33.1

5.33.1 (2026-10-01)

Bug Fixes

• handle virtualization with path item references (#11069) (38f0ef0)

v5.33.0

5.33.0 (2026-09-16)

Bug Fixes

• icons: operation copy-to-clipboard icon visibility (#11050) (45119d8)

Features

• add virtualization for schemas and operations (#11019) (0ad38e9)

v5.32.15

5.32.15 (2026-09-04)

Bug Fixes

• oas32: include query in default supportedSubmitMethods (#11021) (c26e573)
• use scoped DOMPurify instance to avoid mutating global (#11029) (182fb83)

v5.32.14

5.32.14 (2026-08-18)

... (truncated)

Commits

• 38ca10e chore(release): cut the 5.33.3 release
• f170383 fix(deps): bump swagger-client to v3.38.3 (#11096)
• e89a91f chore(release): cut the 5.33.2 release
• 7f26236 fix(json-schema-5): move early return after useCallback in models (#11082)
• cfd955e chore(deps): bump postcss-selector-parser from 7.1.5 to 7.1.6 (#11083)
• 553cf09 chore(deps-dev): bump joi from 17.13.7 to 17.13.8 (#11087)
• d19e961 chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#11085)
• 5672801 chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 (#11086)
• 2addfaf chore(deps): bump shell-quote from 1.10.0 to 1.12.0 (#11084)
• 121c488 chore(deps): bump aquasecurity/trivy-action (#11079)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.