Bump dompurify and swagger-ui in /frontend

[dependabot]

Bumps dompurify to 3.4.13 and updates ancestor dependency swagger-ui. These dependencies need to be updated together.

Updates dompurify from 3.2.6 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

DOMPurify 3.4.7

• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker

... (truncated)

Commits

• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• bb7739e release: 3.4.6 (#1394)
• 011b0c7 release: 3.4.5 (#1382)
• 5817ad9 release: 3.4.4 (#1374)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates swagger-ui from 5.31.2 to 5.32.13

Release notes

Sourced from swagger-ui's releases.

v5.32.13

5.32.13 (2026-08-11)

Bug Fixes

• a11y: add aria-labels to copy-to-clipboard buttons (#10842) (e6ce7d8)
• a11y: add skip-to-operations link, banner and main landmarks (#10849) (92669ea)
• a11y: close Authorization popup with Escape key and backdrop click (#10987) (311b0d2)
• a11y: name and state for dark-mode toggle button (#10848) (13a90fa)
• a11y: restore icon visibility in Windows High Contrast Mode (#10846) (edec467)
• a11y: topbar logo and dark-mode toggle visible in HCM (#10847) (6beaebd)
• a11y: use for model titles to convey emphasis semantically (#10876) (b4501b6)
• ci: bump cycjimmy/semantic-release-action to v6.0.0 (#11001) (9b3eacb)
• ci: fix Trivy security scan and add dependency vulnerability scan (#10996) (ff221a8)
• style: reduce padding on inline code blocks in markdown (#7569) (#10789) (a1a6cdc)

Huge thanks to our contributors who made this release happen: @​bmatar, @​yogeshwaran-c, @​jonnyjackson26, @​rkdfx, and @​adrianodpdiaz

v5.32.12

5.32.12 (2026-08-03)

Bug Fixes

• deps: bump swagger-client to v3.37.8 (#10980) (1a88283)

v5.32.11

5.32.11 (2026-07-22)

Bug Fixes

• deps: bump dompurify from 3.4.11 to 3.4.12 (#10972) (0aa8457)
• deps: bump immutable to 4.3.9 (#10969) (159423c)

v5.32.10

5.32.10 (2026-07-21)

Bug Fixes

• deps: bump axios from 1.16.0 to 1.18.1 (#10963) (878390c)
• deps: bump swagger-client to 3.37.7 (#10968) (d353bcd)

v5.32.9

5.32.9 (2026-07-17)

... (truncated)

Commits

• 2a33d78 chore(release): cut the 5.32.13 release
• 9b3eacb fix(ci): bump cycjimmy/semantic-release-action to v6.0.0 (#11001)
• 5fd1674 chore(deps): bump docker/build-push-action (#10998)
• 19302a9 chore(deps): bump dependabot/fetch-metadata (#10997)
• a1a6cdc fix(style): reduce padding on inline code blocks in markdown (#7569) (#10789)
• e6ce7d8 fix(a11y): add aria-labels to copy-to-clipboard buttons (#10842)
• 92669ea fix(a11y): add skip-to-operations link, banner and main landmarks (#10849)
• edec467 fix(a11y): restore icon visibility in Windows High Contrast Mode (#10846)
• 311b0d2 fix(a11y): close Authorization popup with Escape key and backdrop click (#10987)
• 6beaebd fix(a11y): topbar logo and dark-mode toggle visible in HCM (#10847)
• Additional commits viewable in compare view