chore(deps): bump dompurify to 3.4.13; re-verify the image-size allowlist (#1769)

* chore(deps): bump dompurify to 3.4.13 for GHSA-55q2-fjhq-7xh7

DOMPurify <=3.4.12 leaves a detached subtree executable after IN_PLACE
hook removal, which allows XSS. 3.4.13 is the patched release.

dompurify is a direct dependency of geolibre-desktop at ^3.4.12, and the
three transitive consumers (@cesium/engine, @geoman-io/maplibre-geoman-free,
maplibre-gl-geoagent) all declare ranges that accept 3.4.13, so this is an
in-range `npm update` of the single deduped copy -- lockfile only, no
package.json change and no breaking upgrade.

This clears the only actionable advisory in `npm audit`. The remaining 16
high findings are all the image-size DoS pair (GHSA-w3rx-r6r6-pgpr,
GHSA-5p2g-fcmc-qvqq), which are already allowlisted in
scripts/audit-check.mjs; both halves of that rationale still hold --
image-size@2.0.2 is still the latest publish and the advisory covers
<=2.0.2, and it reaches us only through texture-compressor, which
@loaders.gl/textures shells out to via npx from a Node-only encoder
GeoLibre never calls.

* docs(audit): record the re-verified image-size allowlist rationale

Both image-size advisories were re-checked against the GitHub advisory
API, which reports first_patched_version: null for each — there is no
version to upgrade to, and 2.0.2 remains the newest release ever
published. Upgrading higher in the chain does not help either: the
latest @loaders.gl/textures (4.4.4) still depends on
texture-compressor@^1.0.2, which pins image-size@^0.7.4.

Unreachability was re-confirmed by grepping the production build, which
contains no reference to image-size or texture-compressor — consistent
with @loaders.gl/textures reaching the encoder by spawning it as a child
process (`command: 'npx'`) rather than importing it.

Also notes why the raw `npm audit` count is alarming and misleading: it
inflates these two advisories into ~16 high findings by counting them
once per package in the dependency chain, when the tree only ever holds
a single copy of image-size.

No behavior change — comments only.

Author: giswqs

package-lock.json

@@ -19,17 +19,27 @@ const ALLOWLIST = new Map([
   [
     "GHSA-w3rx-r6r6-pgpr",
     "image-size DoS (ICNS parser infinite loop). No patched version exists — " +
-      "the advisory covers <=2.0.2 and 2.0.2 is the latest release. It reaches " +
+      "the advisory covers <=2.0.2, 2.0.2 is the latest release, and the GitHub " +
+      "advisory API reports first_patched_version: null. Nor can we upgrade past " +
+      "it: the latest @loaders.gl/textures (4.4.4) still depends on " +
+      "texture-compressor@^1.0.2, which pins image-size@^0.7.4. It reaches " +
       "us only as a dependency of texture-compressor, which @loaders.gl/textures " +
       "spawns via `npx` from encodeImageURLToCompressedTextureURL (a Node-only " +
       "encoder). GeoLibre never calls that encoder and it cannot bundle into the " +
-      "browser build, so no attacker-supplied image is ever parsed by it.",
+      "browser build, so no attacker-supplied image is ever parsed by it — " +
+      "confirmed by grepping the production build, which contains no reference " +
+      "to image-size or texture-compressor. Re-verified 2026-08-07.",
   ],
   [
     "GHSA-5p2g-fcmc-qvqq",
     "image-size DoS (JXL/HEIF parser infinite loops). Same package, same lack of " +
       "a patched version, and the same unreachable texture-compressor path as " +
-      "GHSA-w3rx-r6r6-pgpr above.",
+      "GHSA-w3rx-r6r6-pgpr above. Note that plain `npm audit` inflates these two " +
+      "advisories into ~16 high findings by counting them once per package in the " +
+      "chain (texture-compressor → @loaders.gl/textures → gltf/3d-tiles/i3s → " +
+      "deck.gl → the maplibre-gl-* wrappers). There is only ever one copy of " +
+      "image-size in the tree; `npm ls image-size` is the honest count. " +
+      "Re-verified 2026-08-07.",
   ],
 ]);