[AAASM-3427] ⬆️ (deps): bump dompurify 3.4.11 + http-proxy-middleware 3.0.6 (Dependabot)

[Chisanan232]

Target

Remediate 2 moderate Dependabot alerts on the default branch, both transitive in website/pnpm-lock.yaml.

• Task summary:

  Bump dompurify to 3.4.11 and http-proxy-middleware to 3.0.6+ in the standalone Docusaurus website/ project via pnpm.overrides in website/package.json, regenerate the lockfile, and verify a clean install + build.

• Task tickets:

  • Task ID: AAASM-3427.
  • Relative task IDs:
    • AAASM-3427 — node-sdk: remediate 2 Dependabot alerts (dompurify, http-proxy-middleware) in website.
  • Relative PRs:
    • N/A.

• Key point change (optional):

  • [AAASM-2097] 🐛 (ci): Pass --tag alpha to pnpm publish for pre-release versions #56 [MED] dompurify <=3.4.10 → 3.4.11. The pre-existing override floor ^3.4.9 still allowed the vulnerable 3.4.10; raised to ^3.4.11 (now resolves to 3.4.11).
  • [AAASM-1934] 🔖 (sdk): Bump node-sdk packages to 0.0.1-alpha.1 #55 [MED] http-proxy-middleware >=0.16.0,<3.0.6 → 3.0.6. Added override ^3.0.6 (now resolves to 3.0.7). This package is consumed only by webpack-dev-server at dev time and is not part of the production build output.

Effecting Scope

• Action Types:
  • 🍀 Improving something (performance, code quality, security, etc.)
• Scopes:
  • 🚀 Building
    • 🔗 Dependencies
    • 📦 Project configurations
  • 📚 Documentation
• Additional description:
  Scoped strictly to website/ (Docusaurus docs site). No changes to the SDK's native/JS package dependencies — neither alert touches them.

Description

• website/package.json: bump dompurify override ^3.4.9 → ^3.4.11; add http-proxy-middleware override ^3.0.6.
• website/pnpm-lock.yaml: regenerated via pnpm install --ignore-workspace (required so the standalone website/ overrides actually apply).

Local validation

• cd website && pnpm install --ignore-workspace — clean.
• pnpm why dompurify → dompurify 3.4.11.
• pnpm why http-proxy-middleware → http-proxy-middleware 3.0.7.
• pnpm build → exit 0, [SUCCESS] Generated static files in "build".

Closes AAASM-3427.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Chisanan232]

🟢 Review result — Claude Code (AAASM-3427, node-sdk)

Verdict: APPROVED — ready for approval & merge.

1. CI status — green

tests (18/20/22/24) ✅ · build ✅ · napi-build (20 + 22) ✅ · module-smoke (18/20/22) ✅ · quality ✅ · SonarCloud ✅ · codecov/patch ✅ · coverage-and-analysis ✅ · CodeQL ✅.

Note: napi-build (22) initially failed on a transient crates.io network flake (curl failed / HTTP2 framing error fetching napi-derive-backend) while the 20 leg passed on identical code — purely infra, unrelated to this docs-only change. Re-ran the job → pass.

2. Scope vs ticket (AAASM-3427)

• ✅ dompurify 3.4.10 → 3.4.11 ([AAASM-2097] 🐛 (ci): Pass --tag alpha to pnpm publish for pre-release versions #56) and http-proxy-middleware 2.0.9 → 3.0.7 ([AAASM-1934] 🔖 (sdk): Bump node-sdk packages to 0.0.1-alpha.1 #55), via website/package.json pnpm.overrides. Good catch: the prior ^3.4.9 dompurify floor still permitted the vulnerable 3.4.10.
• ✅ Validated locally: pnpm build exit 0; both deps confirmed above the vulnerable ranges. Scope limited to website/; SDK native/JS deps untouched. Base master on remote, not self-merged.

Scope fully delivered. Ready to merge.