[release-1.9] chore(deps): patches dompurify for CVE-2026-41240

[alizard0]

Fixes CVE-2026-41240 by patching dompurify to 3.40 or higher using surgeon.
https://redhat.atlassian.net/browse/RHIDP-13315

Upstream work: microsoft/vscode#318354 and microsoft/vscode#320010

CVE-2026-41240 dompurify
  patch: 3.4.0
  affected: < 3.4.0
root@1.9.6 /Users/alizardo/Documents/engineering/github/rhdh
└─┬ app@1.0.1 -> ./packages/app
  └─┬ @backstage/plugin-api-docs@0.13.1
    ├─┬ @asyncapi/react-component@2.6.3
    │ └─┬ isomorphic-dompurify@2.22.0
    │   └── dompurify@3.2.6 deduped
    └─┬ swagger-ui-react@5.30.3
      └── dompurify@3.2.6
Upgrading dependency with yarn-lockfile-surgeon → dompurify@3.4.0 ...
root@1.9.6 /Users/alizardo/Documents/engineering/github/rhdh
└─┬ app@1.0.1 -> ./packages/app
  └─┬ @backstage/plugin-api-docs@0.13.1
    ├─┬ @asyncapi/react-component@2.6.3
    │ └─┬ isomorphic-dompurify@2.22.0
    │   └── dompurify@3.4.0
    └─┬ swagger-ui-react@5.30.3
      └── dompurify@3.2.6

CVE-2026-41240 dompurify
  patch: 3.4.0
  affected: < 3.4.0
dynamic-plugins-root@1.9.6 /Users/alizardo/Documents/engineering/github/rhdh/dynamic-plugins
├─┬ backstage-plugin-techdocs@1.16.0 -> ./wrappers/backstage-plugin-techdocs
│ └─┬ @backstage/plugin-techdocs@1.16.0
│   └── dompurify@3.3.1
└─┬ red-hat-developer-hub-backstage-plugin-extensions@0.14.3 -> ./wrappers/red-hat-developer-hub-backstage-plugin-extensions
  └─┬ @red-hat-developer-hub/backstage-plugin-extensions@0.14.4
    └─┬ monaco-editor@0.55.1
      └── dompurify@3.2.7
Upgrading dependency with yarn-lockfile-surgeon → dompurify@3.4.0 ...
dynamic-plugins-root@1.9.6 /Users/alizardo/Documents/engineering/github/rhdh/dynamic-plugins
├─┬ backstage-plugin-techdocs@1.16.0 -> ./wrappers/backstage-plugin-techdocs
│ └─┬ @backstage/plugin-techdocs@1.16.0
│   └── dompurify@3.4.0
└─┬ red-hat-developer-hub-backstage-plugin-extensions@0.14.3 -> ./wrappers/red-hat-developer-hub-backstage-plugin-extensions
  └─┬ @red-hat-developer-hub/backstage-plugin-extensions@0.14.4
    └─┬ monaco-editor@0.55.1
      └── dompurify@3.2.7

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5035
• quay.io/rhdh-community/rhdh:pr-5035-8066a1af

[kim-tsao]

This is still pinned. Can we update it?

[alizard0]

Updated.

[alizard0]

Dompurify is a false-positive:

1. In monaco-editor, dompurify is bundled directly into the source code at build time, it appears in the package.json only for dependency tracking.
2. Monaco-editor does not use the speicifc vulnerable code paths or APIs reported by this CVE.
3. There is an upstream fix already merged into VSCode codebase which will be propagated soon to monaco-editor-core.
4. No seucirty risk to rhdh

[github-actions]

The container image build and publish workflows were skipped (either due to [skip-build] tag or no relevant changes with existing image).

[JessicaJHee]

/test e2e-ocp-helm

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5035
• quay.io/rhdh-community/rhdh:pr-5035-427df3c5

[JessicaJHee]

/test e2e-ocp-helm