[dependabot]

Bumps the dependencies group with 1 update in the / directory: isomorphic-dompurify.

Updates isomorphic-dompurify from 3.19.0 to 4.6.0

Release notes

Sourced from isomorphic-dompurify's releases.

4.6.0: Updated dependencies

• dompurify 3.4.16 -> 3.4.17, range pinned to ^3.4.17
• jsdom 30.1.2 -> 30.1.3
• Dev tooling: tsup 8.5.1 -> 9.0.0, vitest 5.0.3 -> 5.0.4, lefthook 2.1.16 -> 2.2.2
• packageManager pnpm 12.9.1 -> 12.13.0
• Removed the ignoreDeprecations workaround from tsconfig (no longer needed with tsup 9)

Note: DOMPurify 3.4.17 fixes IN_PLACE handling with shadow roots and hooks, the SMIL attributeName guard in XHTML mode, and hardens several smaller edge cases.

4.5.0: Updated dependencies

• jsdom 30.1.1 -> 30.1.2
• dompurify range pinned to ^3.4.16
• Dev tooling: @​biomejs/biome 2.5.14 -> 2.5.15, vitest 5.0.1 -> 5.0.3, lefthook 2.1.14 -> 2.1.16
• packageManager pnpm 12.4.2 -> 12.9.1

4.4.0: Updated dependencies

• dompurify 3.4.15 -> 3.4.16
• jsdom 30.1.0 -> 30.1.1

4.3.0: Updated dependencies

• jsdom 30.0.1 -> 30.1.0
• vitest 5.0.0 -> 5.0.1 (dev)
• @​biomejs/biome 2.5.12 -> 2.5.14 (dev)
• lefthook 2.1.12 -> 2.1.14 (dev)
• pnpm 12.3.4 -> 12.4.2 (tooling)

Note: jsdom 30.1.0 improves resource consumption - clearWindow() now returns the heap fully to baseline (previously ~1.7 MB residual per clear cycle).

4.2.0: Updated dependencies

• dompurify 3.4.14 -> 3.4.15
• vitest 4.1.11 -> 5.0.0 (dev)
• @​biomejs/biome 2.5.11 -> 2.5.12 (dev)
• pnpm/action-setup 6.0.10 -> 6.1.0 (CI)

4.1.0: Align Requirements table with the 4.x Node.js floor

• README Requirements table: the raised Node.js floor is now listed under >=4.0.0 (was >=3.20.0)
• lefthook 2.1.10 -> 2.1.12 (dev)

4.0.0: Semver correction for the Node.js floor bump

This is a major version bump with no functional code changes relative to 3.23.0.

v3.20.0 raised the minimum Node.js version (inherited from jsdom 30) - a breaking change that should have been a major release. 4.0.0 corrects that: the same code as 3.23.0, now on a proper major so ^3.x consumers are not silently upgraded onto a build that dropped their Node.js version.

• Node.js requirement: ^22.22.2 || ^24.15.0 || >=26.0.0 (Node 20 no longer supported)
• Versions 3.20.0-3.23.0 are deprecated on npm - use 4.x, or pin 3.19.0 for Node < 22.22.2 (also available via the node20 dist-tag)
• @​biomejs/biome 2.5.10 -> 2.5.11 (dev)

3.23.0: Updated dependencies

• dompurify 3.4.13 -> 3.4.14
• vitest 4.1.10 -> 4.1.11

... (truncated)

Commits

• a0e160b chore: release 4.6.0
• 0102b37 chore(deps): bump jsdom from 30.1.2 to 30.1.3
• d55c988 chore(deps): align package.json version floors with lockfile
• a244dda chore: remove ignoreDeprecations from tsconfig
• c8805d0 chore: bump pnpm from 12.9.1 to 12.13.0
• 9da3e5c chore(deps-dev): bump lefthook from 2.2.1 to 2.2.2
• df613e2 chore(deps-dev): bump tsup from 8.5.1 to 9.0.0
• da76638 chore(deps): bump dompurify from 3.4.16 to 3.4.17
• 0295a68 chore(deps-dev): bump vitest from 5.0.3 to 5.0.4
• 0e66172 chore(deps-dev): bump lefthook from 2.2.0 to 2.2.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml