[release-1.10] chore(deps): bump to dompurify to >3.4.8

[JessicaJHee]

Description

Targets CVE-2026-49978 and CVE-2026-41240

Bumps `dompurify` to 3.4.12 everywhere except for:

└─┬ red-hat-developer-hub-backstage-plugin-extensions@0.17.1 -> ./wrappers/red-hat-developer-hub-backstage-plugin-extensions
  └─┬ @red-hat-developer-hub/backstage-plugin-extensions@0.17.1
    └─┬ monaco-editor@0.55.1
      └── dompurify@3.2.7

The dompurify upgrade we need in monaco-editor is pre-released in v0.56.0-dev-20260625, but we can't pick that up yet since it's not a stable release.

Since monaco-editor v0.56.0 (which includes the dompurify bump we were waiting for) has released, we can opt to proceed with a full patch by applying a resolution

Which issue(s) does this PR fix

• Relates to RHIDP-15535 and RHIDP-13315 (Doesn't completely close them)

PR acceptance criteria

Please make sure that the following steps are complete:

• GitHub Actions are completed and successful
• Unit Tests are updated and passing
• E2E Tests are updated and passing
• Documentation is updated if necessary (requirement for new features)
• Add a screenshot if the change is UX/UI related

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.60%. Comparing base (bc9db5f) to head (ed93048).
⚠️ Report is 1 commits behind head on release-1.10.

Additional details and impacted files

@@                Coverage Diff                @@
##           release-1.10    #5123       +/-   ##
=================================================
+ Coverage         41.03%   69.60%   +28.57%     
=================================================
  Files               121      111       -10     
  Lines              2220     4702     +2482     
  Branches            562      537       -25     
=================================================
+ Hits                911     3273     +2362     
- Misses             1303     1429      +126     
+ Partials              6        0        -6     

Flag	Coverage Δ
install-dynamic-plugins	92.44% <ø> (?)
rhdh	38.81% <ø> (-2.23%)	⬇️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bc9db5f...ed93048. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5123
• quay.io/rhdh-community/rhdh:pr-5123-4307107a

[alizard0]

/retest-required

[JessicaJHee]

/test e2e-ocp-helm

[github-actions]

The container image build workflow finished with status: failure.

[alizard0]

lgtm

[alizard0]

/retest-required

[alizard0]

/retest

[alizard0]

/retest-required

[alizard0]

/test e2e-ocp-helm

[openshift-ci]

New changes are detected. LGTM label has been removed.

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5123
• quay.io/rhdh-community/rhdh:pr-5123-8ed3ff22

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5123
• quay.io/rhdh-community/rhdh:pr-5123-84fd37c0

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5123
• quay.io/rhdh-community/rhdh:pr-5123-ed930484

[kim-tsao]

I believe this PR has other CVE fixes (js-yaml) in addition to dompurify. Can you rebase since the js-yaml CVE has been merged and focus only on updating dompurify?

[kim-tsao]

can we run a yarn dedupe to resolve these to 1.18.1?

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.