[dependabot]

Bumps dompurify from 3.4.13 to 3.4.16.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

Commits

• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• See full diff in compare view

[defangdevs]

CI status on this PR: the dependency bump itself and the lockfile fix (commit 1182d61) are correct — Lint, Type Check, Build, Test, Code Quality Checks, Secret Scan, and all other functional checks are green.

The two remaining red checks are known, pre-existing issues unrelated to this change:

• Run benchmarks (CodSpeed): fails with 401 Unauthorized — Repository not found or the user does not have access to it — a CodSpeed dashboard auth/config problem that's been failing on every run since 2026-07-11, tracked in CodSpeed CI check auth failing on every run since at least 2026-07-11 #46.
• Preflight Evidence: fails because this PR's body (dependabot's template) has no AGENT_PREFLIGHT_START/END block, and the gate re-activates once a non-dependabot commit lands on the branch (by design — see the ci.yml comment above that step). Confirmed the same failure, independent of any other fix, on PR build(deps): bump hono from 4.13.4 to 4.13.11 in /apps/api #59 — this is a structural gap for bot-authored PRs, not a regression from the lockfile fix.

Flagging so a reviewer with override authority knows these aren't blocking a real issue.