fix(deps): align security pins with the installed dependency graph

[wybaby168]

Summary

• Frozen installs of chore(deps): bump dompurify from 3.4.15 to 3.4.16 in /packages/renderers/pptx #333 and chore(deps): bump dompurify from 3.4.15 to 3.4.16 in the security-updates group across 1 directory #334 still execute DOMPurify 3.4.15 because the workspace override takes precedence. Align all five direct manifests, the override and the lockfile at 3.4.16, and check actual installed runtimes to prevent another manifest-only security update.
• Patch the other current advisories in the complete workspace graph and regenerate the DICOM license ledger without adding audit exceptions.
• Keep this safety update separate from the Geo3D feature review. No npm publication or merge is requested.

Related issue

N/A: dependency advisories and incomplete security PRs #333/#334, rather than a new rendering issue. Leave release-dependent issues open until the maintained npm release is verified.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Node 24.20.0 / pnpm 11.0.9; all results below completed locally before push.

Check	Result
pnpm install --frozen-lockfile	Pass
pnpm audit --registry=https://registry.npmjs.org --audit-level=low	Pass: zero nonignored advisories; one existing Vue 2 EOL exception
pnpm audit:renderer-deps, pnpm verify:dicom-license-ledger, signature license verification	Pass
pnpm verify:github-governance	Pass: 49 checks passed, one existing environment-dependent skip
pnpm build, pnpm type-check, pnpm test, pnpm docs:build	Pass
pnpm exec vitest run	Pass: 258 tests passed, one existing skip
Every remaining .github/workflows/public-ci.yml runtime step, including cold React/Vue CLI/Angular consumers and Chromium/WebKit Worker/WASM tests	Pass
bash .github/scripts/run-gitleaks.sh	Pass: 957 commits scanned, no leaks

Fresh tarball consumers install DOMPurify 3.4.16 without inheriting workspace security overrides.

Sample / fixture evidence

Existing regressions were rerun with repository fixtures including apps/viewer-demo/public/example/word.docx and apps/viewer-demo/public/example/ppt.pptx. Original #333/#334 heads were frozen-installed independently; their patched manifests resolved the old 3.4.15 runtime before this fix. No new format fixture is needed for the installed-dependency consistency assertion.

Visual evidence

N/A: no visual or file-format behavior change. Existing rendering, sanitization, offline browser and cold-consumer gates were rerun.

Risk and compatibility

• Affected packages/formats: core, DOC, drawing, PPTX, text, static documentation and audited transitive dependencies. DICOM notices describe the exact updated installed closure. Repository governance classifies renderer manifest updates as renderer changes; parsing behavior itself is unchanged.
• Compatibility or migration risk: consumers do not inherit workspace overrides. Mermaid still resolves upstream KaTeX 0.16.47 in a fresh npm tree; this PR does not claim every consumer dependency tree is advisory-free. The workspace uses patched KaTeX 0.18.2.
• The documented Vue 2 EOL advisory remains the sole workspace exception. Static docs contain no next/og calls; the Next bump addresses the dependency advisory without claiming an exploited application path.
• Rollback: revert this commit, which also restores the previous manifest/lock/notice set and its known audit failures.

Checklist

• I added focused automated coverage for actual installed DOMPurify and manifest/override agreement.
• No public API or behavior documentation change is needed; license notices were regenerated.
• Existing offline, Worker/WASM and cold-consumer paths were fully verified.
• I did not commit secrets, private samples, generated caches or unrelated changes.

Independent verification update — 2026-10-07

Current head: 55f4392e02fc77d9a82830194cfd7930fb8bd95f.

• Added the narrowly scoped Sharp 0.35.5 override/lock closure and an assertion that resolves Sharp through the installed Next package. Next remains 16.3.6. The original 0.35.4 graph reproduced GHSA-wq5f-xc86-pv6w before this fix.
• The exact candidate passed a complete independent Linux build, type-check and documentation build on 2026-10-06. Its bytes were rechecked unchanged on 2026-10-07; frozen-install consistency, dependency cohort, governance, official audit and all 30 root Vitest files passed again (258 tests, one existing optional-fixture skip). Node 24.20.0, pnpm 11.0.9, dedicated HOME and cleared NODE_PATH were used.
• Official workspace audit exits successfully with zero nonignored advisories. The existing Vue 2 low-severity exception remains; this is not a claim that every published or cold-consumer dependency graph is clean.
• Fresh exact-head Public CI and Security completed successfully on 2026-10-07. All runtime/build/browser/packed-consumer gates in Public CI ran. These hosted results supplement the independent cloud shell checks; the cloud shell's own browser gates remain blocked by its execution prerequisites.
• Fresh packed-consumer installs still report 42 affected-package entries in the legacy Vue CLI/React fixture and 4 in Angular tooling (2 high, 2 critical). Functional CI is not a clean consumer-security claim. A separate focused fixture repair is being validated; no merge or npm publication has occurred.

[wybaby168]

Closing as covered by main fa4035f9f133079978ebf33d86606c2dbf00e6ea. Reviewed head: 55f4392e02fc77d9a82830194cfd7930fb8bd95f.

All 11 changed paths have corresponding implementations on main:

• The five published manifests (core, DOC, drawing, PPTX and text) declare DOMPurify 3.4.16 directly, with matching frozen importers. The workspace selectors and lock overrides also retain this PR's Sharp 0.35.5, brace-expansion 1.1.21, devalue 5.9.3, fast-uri 3.1.8, KaTeX 0.18.2, source-map-js 1.2.2 and compression 1.8.2 targets.
• The docs site's frozen Next 16.3.8 snapshot resolves Sharp 0.35.5. The original DOMPurify and physically resolved Next/Sharp guards are preserved verbatim and passed in the existing main Core CI.
• The DICOM ledger and notices retain this PR's three attribution targets: brace-expansion 1.1.21, DOMPurify 3.4.16 and source-map-js 1.2.2. The existing main dependency audit verified the generated ledger and notices for all 95 current runtime/SDK-source packages. The existing Vue 2 audit exception was not widened.

These requirements are therefore retained without merging the older branch. This closure records coverage on main; it does not assert that every independent consumer's development dependency graph has no audit findings.