chore: upgrade dompurify to ^3.4.13 to address GHSA-55q2-fjhq-7xh7

[claude]

Fixes SOU-1899

Refreshes the yarn.lock entry for dompurify from 3.4.12 to 3.4.13, which fixes GHSA-55q2-fjhq-7xh7 (IN_PLACE hook removal leaves a detached subtree executable, causing XSS).

dompurify is transitive here, reached via mermaid (^3.3.3) and posthog-js (^3.3.2). Both existing ranges already admit the patched release, so this is a lockfile refresh only. No manifest change and no resolutions override are needed.

Verification

• yarn why dompurify reports both requesters resolving to dompurify@npm:3.4.13, with no affected version remaining in the graph.
• yarn install completes with no further lockfile churn.
• yarn workspace @sourcebot/web test --run: 101 files, 1191 tests passed.

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only dependency patch for a known XSS advisory; no application code changes, though dompurify is used indirectly for HTML sanitization (e.g. mermaid).

Overview
Bumps the resolved transitive dompurify version from 3.4.12 to 3.4.13 in yarn.lock to address GHSA-55q2-fjhq-7xh7 (XSS when IN_PLACE hook removal leaves a detached subtree executable). No package.json or resolutions changes—existing ranges from mermaid and posthog-js already allow 3.4.13.

Documents the upgrade under Unreleased → Fixed in CHANGELOG.md.

^{Reviewed by Cursor Bugbot for commit e002872. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

@claude[bot] your pull request is missing a changelog!

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.