Fix 5 open Dependabot npm alerts (dompurify, uuid)

[badrishc]

Summary

Fixes all 5 open Dependabot security alerts in the website npm dependencies.

dompurify 3.3.3 → 3.4.0 (fixes 4 alerts)

• Remove ifdefs from ClusterStress to fix build #82 ADD_TAGS function form bypasses FORBID_TAGS
• Create IHeyReally #83 CVE-2026-41238: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING
• Enhance Code Readability #84 CVE-2026-41240: FORBID_TAGS bypassed by function-based ADD_TAGS predicate
• Plans for an IDistributedCache implementation? #85 CVE-2026-41239: SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

uuid 8.3.2/11.1.0 → 14.0.0 (fixes 1 alert)

• security-scan found error SCS0005: Weak random number generator #86 Missing buffer bounds check in v3/v5/v6 when buf is provided

Validation

• yarn install succeeds
• yarn build succeeds — website builds cleanly

Note on uuid 14.0.0

uuid 14 is ESM-only. The two consumers in the dependency tree are:

• mermaid (previously uuid ^11.1.0) — ESM, compatible
• sockjs (previously uuid ^8.3.2) — CJS, used only by webpack-dev-server during docusaurus start (dev mode). The sockjs code path only calls uuid.v4() which is unaffected by the vulnerability (v3/v5/v6 buffer bounds). If dev-server issues arise, the resolution can be scoped to mermaid/uuid only.

[Copilot]

Pull request overview

Updates the website’s Yarn-managed npm dependency graph to remediate Dependabot security alerts by pinning patched versions of vulnerable transitive packages.

Changes:

• Bump dompurify to 3.4.0 via Yarn resolutions and lockfile update.
• Force uuid to 14.0.0 via Yarn resolutions and lockfile update.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
website/package.json	Pins dompurify and uuid versions via Yarn resolutions to address security alerts.
website/yarn.lock	Updates the resolved versions/hashes for dompurify and uuid accordingly.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[badrishc]

Thanks for the review! I investigated the scoped mermaid/**/uuid approach, but Yarn v1 doesn't actually apply it — the lockfile still resolved uuid@^11.1.0 to 11.1.0 with the scoped override.

However, the CJS compatibility concern is not an issue here because Node.js 22+ natively supports require() of ESM-only packages (the --experimental-require-module flag was removed and became default behavior). Since engines requires node >= 22, sockjs's require('uuid').v4 works fine with uuid 14.0.0.

I verified this:

• node -e "const uuid = require('uuid'); console.log(uuid.v4());" → works ✅
• yarn build → succeeds ✅
• yarn start (dev server with sockjs/webpack-dev-server) → starts cleanly ✅

Updated to use the global uuid: 14.0.0 resolution since the scoped approach doesn't work with Yarn v1 and Node.js 22+ handles the ESM/CJS interop.