Bump dompurify from 3.4.11 to 3.4.14

[superagent-security-dev]

Bumps dompurify from 3.4.11 to 3.4.14.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

Commits

• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• See full diff in compare view

---

Superagent evaluated the complete generated dependency delta before opening this pull request.

Nonblocking supply chain signals: es-abstract@1.24.2 has unspecified_code_anomaly risk; es-abstract@1.24.2 has url_strings risk; function.prototype.name@1.2.0 has external_url_fragments risk; hasown@2.0.4 has dependency_scoped_alert risk; is-core-module@2.16.2 has inherited_dependency_alert risk; string.prototype.trimend@1.0.9 has obfuscated_code risk; which-typed-array@1.1.22 has dependency_inherited_alert risk; which-typed-array@1.1.22 has maintenance_override_recommendation risk

[homanp]

Closing the Secure Dependency Updates integration test before rerunning with immutable GitHub Action pins.

[homanp]

Closing the previous integration test before validating dependency file restrictions.