Bump dompurify from 3.4.11 to 3.4.12 in /socratiq

[dependabot]

Bumps dompurify from 3.4.11 to 3.4.12.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

Commits

• a9ca1e5 release: 3.4.12 (#1537)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Shashank-Tripathi-07]

Checked why CI is red here, and this one actually needs a fix before merge, not just a shrug.

dompurify is a direct dependency here, marked in package.json as the XSS sanitizer for AI-generated content, and it's directly imported in streamdown_markdown.js. The failing check is verify-bundle-matches-source. socratiq ships a separate pre-built file, book/quarto/tools/scripts/socratiQ/bundle.js, and there's a workflow that rebuilds that bundle fresh and fails if it doesn't match what's committed. Dependabot only touches package.json and the lockfile, it can't run the build step, so the committed bundle.js still has the old dompurify code baked in.

Confirmed this isn't a blanket failure on every Dependabot PR here, postcss and seroval bumps on this same project passed this exact check recently, because those two aren't actually reachable in the bundled runtime code. dompurify is, so bumping it genuinely changes what a fresh build produces, and the check is correctly catching that drift.

There's precedent too, a dompurify 3.4.10 to 3.4.11 bump failed this same check back in June, fixed by a separate PR that just ran the rebuild and committed it.

If this merges as-is, package.json says 3.4.12 but the actual bundle.js users load still ships the old 3.4.11 code, so the fix doesn't actually reach anyone. Needs npm run build:vite in socratiq/ and the regenerated bundle.js committed alongside this bump before it's safe to merge.

[dependabot]

Superseded by #1997.