fix(deps): bump isomorphic-dompurify from 2.26.0 to 2.36.0

[dependabot]

Bumps isomorphic-dompurify from 2.26.0 to 2.36.0.

Release notes

Sourced from isomorphic-dompurify's releases.

2.35.0: Updated jsdom

Changelog

• Updated jsdom.
• Updated dev dependencies.

See the complete changelog for more details.

Release

2.35.0

2.34.0: Updated dependencies

Changelog

• Updated dompurify and jsdom.
• Updated dev dependencies.

See the complete changelog for more details.

Release

2.34.0

2.33.0: Improved Web Worker support

Changelog

• Improved Web Worker compatibility (partial) #242 (thanks @​wSedlacek for the contribution and @​coderabbitai for advice)

See the complete changelog for more details.

Release

2.33.0

2.32.0: Updated dependencies

Changelog

• Updated jsdom.
• Updated dev dependencies.

See the complete changelog for more details.

Release

2.32.0

2.31.0: Updated dependencies

Changelog

... (truncated)

Commits

• 77d1437 chore: Incremented project version.
• 227f862 Merge pull request #386 from kkomelin/dependabot/npm_and_yarn/jsdom-28.0.0
• 1f80b7c chore(deps): bump jsdom from 27.4.0 to 28.0.0
• cdfc27b Merge pull request #385 from kkomelin/dependabot/npm_and_yarn/vitest-4.0.18
• 2b8b07d chore(deps-dev): bump vitest from 4.0.17 to 4.0.18
• 4951404 Merge pull request #384 from kkomelin/dependabot/npm_and_yarn/terser-5.46.0
• 9e2b51c chore(deps-dev): bump terser from 5.44.1 to 5.46.0
• d0a98c2 Merge pull request #383 from kkomelin/dependabot/npm_and_yarn/vitest-4.0.17
• 00deefd chore(deps-dev): bump vitest from 4.0.16 to 4.0.17
• 2cc5a03 Updated deps. Incremented project version.
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[JiwaniZakir]

The isomorphic-dompurify bump from 2.26.0 to 2.36.0 in package.json brings in a notable chain of transitive dependency changes visible in yarn.lock: @asamuzakjp/css-color jumps from ^3.2.0 to ^5.0.1, and all @csstools/* packages move up a major version (e.g., @csstools/css-tokenizer goes from ^3.0.3 to ^4.0.0). These are major version bumps in the CSS parsing stack, which could introduce behavioral differences in how HTML is sanitized — particularly around CSS-based XSS vectors. It's worth verifying that any code paths passing untrusted HTML through dompurify (search for sanitize( calls in the codebase) are covered by tests that exercise CSS attribute and style tag handling. The addition of new packages like @acemir/cssom@^0.9.31, @asamuzakjp/dom-selector, and @exodus/bytes as new transitive dependencies also increases the supply chain surface area and should be confirmed as expected by cross-referencing the isomorphic-dompurify 2.36.0 release notes or changelog to ensure none were introduced unexpectedly.