Update dependencies and refactor DOMPurify usage to default import

[developerkunal]

Changes

• Upgraded dompurify from 2.5.4 to 3.2.5 to address known security vulnerabilities.

• DOMPurify v3 introduced breaking changes, including:

  • Dropped support for Internet Explorer
  • Removed named exports such as sanitize

• Refactored all DOMPurify imports to use the new default import syntax (import DOMPurify from 'dompurify').

• Updated all sanitization calls to use DOMPurify.sanitize(...) for consistency and compatibility.

• Updated ES target from ES5 to ES2017 to enable modern features like async/await, improve compatibility, and drop IE11 support for cleaner, more performant code.

• Modified the following files:

  • src/connection/database/actions.js
  • src/i18n.js
  • src/sanitizer.js
  • src/ui/box/chrome.jsx

• Also upgraded the following dependencies:

  • grunt-cli from 0.1.13 to 1.5.0
  • grunt-env from 0.4.4 to 1.0.1

References

• DOMPurify security advisory for versions < 3.2.5
• GitHub Advisory Database – DOMPurify

Testing

• Verified that the DOMPurify import refactor works correctly in all affected files.

• Ran the full test suite to confirm no regressions.

• This change adds unit test coverage

• This change adds integration test coverage

• This change has been tested on the latest version of the platform/language

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines have been run/followed
• All relevant assets have been compiled

[Copilot]

Pull Request Overview

This PR upgrades the DOMPurify dependency to address security vulnerabilities while refactoring the import style to use the new default import syntax, as well as updating ES targets and other dependencies to support modern features and CI improvements.

• Refactored DOMPurify imports and usage in multiple files
• Upgraded dependencies (DOMPurify, grunt-cli, grunt-env) and updated ES target from ES5 to ES2017
• Modified test configurations including Karma and GitHub Workflow adjustments

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/ui/box/chrome.jsx	Refactored DOMPurify import and usage in React components
src/sanitizer.js	Updated addHook usage to use DOMPurify.default import
src/i18n.js	Replaced named import sanitize with DOMPurify.sanitize in HTML rendering
src/connection/database/actions.js	Updated sanitization call to use DOMPurify and improved safety with config
package.json	Upgraded dependencies and changed ES target for compatibility
karma.conf.js	Adjusted browser configurations for CI (added no-sandbox flag)
.github/workflows/test.yml	Added CI environment variable for running end-to-end tests

[arpit-jn]

LGTM