fix(deps): clear the three advisories failing the Security workflow

[jdevalk]

npm audit --audit-level=high has been failing on main and on every PR again — every check run this week carried a red npm Audit job while gating nothing. Same shape as #144.

What changed

npm audit fix resolved all three within existing semver ranges. No package.json change, no --force.

Package		Severity	Advisory
dompurify	3.4.12 → 3.4.13	moderate	IN_PLACE hook removal leaves a detached subtree executable, causing XSS
js-yaml	4.3.0 → 4.3.1	high	Quadratic CPU consumption in !!omap resolution
nanoid	3.3.16 → 3.3.18	high	Custom generators can loop indefinitely when size is zero

Why this is not lockfile-only

js-yaml and nanoid are transitive build-toolchain deps, so for those a lockfile bump is the whole fix. dompurify is not. It is a direct dependency that scripts/generate-assets.mjs vendors to public/vendor/purify.min.js and ships to browsers, where it backs the Trusted Types default policy in public/trusted-types-policy.js.

The vendored file is tracked in git and does not rebuild on deploy. After npm audit fix it still carried /*! @license DOMPurify 3.4.12, so a lockfile-only commit would have cleared CI while continuing to serve the vulnerable build to visitors — the advisory that actually reaches a user, rather than a runner. npm run assets re-vendors it, so public/vendor/purify.min.js is in this PR.

The SRI hash is computed at build time by sri() in BaseLayout.astro rather than hand-pinned, so it tracks the new bytes automatically. Verified rather than assumed: the built tag's sha384 matches a fresh hash of the shipped file.

Verified

npm audit now reports 0 vulnerabilities.

• lint, format:check, check:skill (168 pages, digest ✓), astro check (0 errors), test:websub, build (168 indexed) — all pass.
• Loaded the built site in a browser, since bumping a library that ships to browsers is the risk here:
  • DOMPurify.version → 3.4.13, isSupported true; the script executes at all, which means the browser validated the SRI.
  • DOMPurify.sanitize('<img src=x onerror=alert(1)>ok') → <img src="x">ok.
  • trustedTypes.defaultPolicy registers; createHTML('<b>hi</b><script>bad()</script>') → <b>hi</b>.
  • ⌘K search overlay still renders sanitised results.
  • No console errors.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying specification-website with    Cloudflare Pages

Latest commit:	3cc0665
Status:	✅  Deploy successful!
Preview URL:	https://6a6efc08.specification-website.pages.dev
Branch Preview URL:	https://fix-audit-advisories-2026-08.specification-website.pages.dev

View logs