Problem
package.json pins dompurify at 3.4.13. The current published release is 3.4.14 (19 August 2026). 3.4.14 includes a bypass fix for configurations that allow-list risky tags, plus mixed-document-context hardening.
Chatwoot uses the default allow-list plus a target=_blank hook, so 3.4.13 is not known-vulnerable for this app. Keeping the pin on the current 3.4.x line still matters for the next bypass that only lands on latest.
Proposed direction
Bump the exact pin 3.4.13 → 3.4.14 and refresh pnpm-lock.yaml. No sanitizer-config change.
Out of scope
- Custom
ALLOWED_TAGS
- Server-side persist sanitization (separate issue)
Happy to open a one-line pin PR from a fork.
Problem
package.jsonpinsdompurifyat 3.4.13. The current published release is 3.4.14 (19 August 2026). 3.4.14 includes a bypass fix for configurations that allow-list risky tags, plus mixed-document-context hardening.Chatwoot uses the default allow-list plus a
target=_blankhook, so 3.4.13 is not known-vulnerable for this app. Keeping the pin on the current 3.4.x line still matters for the next bypass that only lands on latest.Proposed direction
Bump the exact pin
3.4.13→3.4.14and refreshpnpm-lock.yaml. No sanitizer-config change.Out of scope
ALLOWED_TAGSHappy to open a one-line pin PR from a fork.