[Snyk] Security upgrade dompurify from 1.0.11 to 2.5.0

[CentralIntel]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	703/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.2	Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-8184974	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: dompurify

The new version differs by 250 commits.

• 7f6cf8a chore: Updated some packages
• 6f9902d docs: Updated year in LICENSE file for 2.x as well
• 2dcadf0 chore: Preparing 2.5.0 release
• 28381af feature: Added SAFE_FOR_XML flag and code to 2.x branch
• 79cfb37 chore: Preparing 2.4.9 release
• 0940755 fix: Merged relevant changes from main for 2.4.9
• 416ba67 chore: Preparing 2.4.8 release
• 4035e3a chore: Preparing 2.4.8. release
• f0e75b0 fix: cherry-picked fixes for XML & CE bypass
• ef731c0 chore: Preparing 2.4.7. release
• 5b7dff9 chore: Preparing 2.4.6 release
• a01c083 Fix: addressed a bypass on jsdom 22 when noframes tag is allowed
• f464d95 chore: preparing 2.4.5 release
• fa4e8ee chore: preparing 2.4.4 release
• f5c25ac see GraphQL schema update atom/github#767
• 08e9fab test: Added 2.x tag to 2.x branch actions
• 5f766bc See Flake: "GithubPackage ... beforeEach hook for refreshes the appropriate Repository" atom/github#761
• 90326ef Merge pull request Don't show file list context menu when right-clicking header atom/github#750 from cure53/dependabot/npm_and_yarn/json5-1.0.2
• fade506 chore: Prepare 2.4.3, final feature release compatible w. MSIE10/11
• 3afe389 build(deps): bump json5 from 1.0.1 to 1.0.2
• f1e180f fix: merged from latest main
• 7707778 Update README.md
• 5267b04 chore: Preparing 2.4.2 release
• d1dd037 fix: Fixed a prototype pollution bug reported by @ kevin_mizu

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)