Bump dompurify and ngx-markdown in /report/report-ng

[dependabot]

Bumps dompurify to 3.4.10 and updates ancestor dependency ngx-markdown. These dependencies need to be updated together.

Updates dompurify from 3.1.4 to 3.4.10

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

DOMPurify 3.4.7

• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
• Removed a problem leading to permanent hook pollution, thanks @​offset
• Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

• Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
• Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
• Added more test coverage for IN_PLACE and general DOM Clobbering attacks
• Bumped several dependencies where possible

DOMPurify 3.4.5

• Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @​KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

DOMPurify 3.4.4

• Added the selectedcontent element to default allow-list, thanks @​lukewarlow
• Added the command and commandfor attributes to default allowed-list, thanks @​lukewarlow
• Added better template scrubbing for IN_PLACE operations, thanks @​DEMON1A
• Added stronger checks for cross-realm windows, thanks @​DEMON1A & @​fg0x0
• Updated demo website and made sure it uses the latest from main
• Updated existing workflows, fuzzer, dependabot, etc., added more tests
• Bumped several dependencies where possible

... (truncated)

Commits

• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• bb7739e release: 3.4.6 (#1394)
• 011b0c7 release: 3.4.5 (#1382)
• 5817ad9 release: 3.4.4 (#1374)
• 520edb0 release: 3.4.3 (#1352)
• 6f67fd3 Sync/3.4.2 (#1322)
• 5b0cdbb chore: merge main into 3.x for 3.4.1 release (#1301)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates ngx-markdown from 14.0.1 to 22.0.0

Release notes

Sourced from ngx-markdown's releases.

v22.0.0

Update Angular 22

It is recommended to stick with ngx-markdown v21.x.x if you are using Angular 21.

New features and enhancements

• Add support for Angular 22
• Migrate math rendering with KaTeX from katex/auto-render to marked-katex-extension fixing important rendering problems
• Deprecate MarkdownModule, which will be removed in the next major release in favour of provideMarkdown

⚠ Breaking changes

Fix for KaTeX math rendering

• KaTeX support now requires the optional marked-katex-extension package in addition to katex.
• Global KaTeX options can now be provided through the new katexOptions provider config in MarkdownModule.forRoot() or provideMarkdown() using the KATEX_OPTIONS injection token.
• Updated KaTeX installation instructions: include katex.min.css and do not rely on the old KaTeX auto-render script configuration.

Migration guidance

Remove the old KaTeX script entries and keep styles entry from angular.json:

"styles": [
+ "node_modules/katex/dist/katex.min.css"
],
"scripts": [
- "node_modules/katex/dist/katex.min.js",
- "node_modules/katex/dist/contrib/auto-render.min.js",
]

Install new extension:

npm install katex@^0.16.0 marked-katex-extension@^5.0.0 --save

If you previously used MarkdownService.render() with katex or katexOptions, move KaTeX configuration to the new provider-style setup and enable KaTeX at parse time instead.

📘 See the Math Rendering section in the README.md for more information.

Commits

• chore(ci): increase demo build budget by @​jfcere in jfcere/ngx-markdown#652
• feat!: update to angular 22 by @​jfcere in jfcere/ngx-markdown#659
• fix(katex)!: fix parsing by migrating to marked-katex-extension by @​jfcere in jfcere/ngx-markdown#660
• deprecate(module): mark MarkdownModule as deprecated by @​jfcere in jfcere/ngx-markdown#661

Security fixes

• build(deps): bump postcss from 8.5.8 to 8.5.14 by @​dependabot[bot] in jfcere/ngx-markdown#647

... (truncated)

Commits

• a1ad6d1 22.0.0
• 62dee2a deprecate(module): mark MarkdownModule as deprecated (#661)
• c8687c2 fix(katex)!: fix parsing by migrating to marked-katex-extension (#660)
• 1dc2460 feat!: update to angular 22 (#659)
• b0dd652 build(deps): bump hono from 4.12.18 to 4.12.23 (#656)
• 19104c9 build(deps): bump tmp from 0.2.5 to 0.2.7 (#655)
• 194de40 chore(ci): increase demo build budget (#652)
• 55e217d build(deps): bump mermaid from 11.13.0 to 11.15.0 (#651)
• aba8e6c build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#650)
• 6bc7c4f build(deps): bump hono from 4.12.14 to 4.12.18 (#649)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.