[dependabot]

Bumps dompurify from 3.4.15 to 3.4.17.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

Commits

• a77a3e7 release: 3.4.17 (#1672)
• b9b9d80 release: 3.4.16 (#1636)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
develop-docs	Ready	Preview	Oct 26, 2026 8:09pm UTC
sentry-docs	Ready	Preview	Oct 26, 2026 8:09pm UTC

[github-actions]

Please update the IS YOUR CHANGE URGENT? section of the PR description:

• Select exactly one option.
• If you selected an urgent or other deadline, provide the date as YYYY-MM-DD.

This information helps the Docs team prioritize your review.

[cursor]

The plan checks search query volume, search-path JavaScript errors, and sanitizer client errors. An issue escalates when search queries collapse while pages still load. New errors in search result rendering also escalate.

Services: sentry-docs, develop-docs.

Mention @change-monitor in a comment to update the plan.

Plan

What changed

Search result titles and snippets now sanitize with DOMPurify 3.4.17. The call still allows only mark tags. sentry-docs and develop-docs must deploy before the new sanitizer is live. Both Vercel production projects build this shared package. The search UI lives in shared src, so both apps ship it. Runtime applicationKey is sentry-docs on both builds. Sentry projects are docs and develop-docs.

Risk

A sanitizer throw breaks the search result list during render. Users then cannot open docs hits from search. A stricter sanitizer may strip mark highlights and leave blank titles. A weaker sanitizer may allow unsafe HTML in hit snippets. That blast radius is the client search dropdown on both sites.

Intended effect

This bump adds no new success counter. Search hits still take the render path that calls sanitize. Confirm docs.search.query still increments after deploy. Absent looks like page loads holding while that search counter stays near zero.

Search volume is weekday-heavy. The prior 24h window was Sunday and is not a weekday peer.

Signal	Baseline	Window	Source	Rule
docs.search.query on project docs, environment production	1471 events in 24h. 1272 had results. About 315 events in the prior 24h. 7-day total 11152, mean about 1593 per day	2026-10-25T20:04:21Z to 2026-10-26T20:04:21Z. Prior 24h 2026-10-24T20:04:21Z to 2026-10-25T20:04:21Z. 7-day 2026-10-19T20:04:21Z to 2026-10-26T20:04:21Z	Sentry org sentry, project docs, metric docs.search.query	Hold. On a weekday, a 24h count near the Sunday 315 while docs.page.load holds is absent
docs.search.query per docs.page.load on project docs	1471 / 18216, about 8.1%. Prior 24h about 315 / 18310, about 1.7%	Same 24h windows as the row above	Sentry org sentry, project docs, metrics docs.search.query and docs.page.load	Hold inside 1.7-8.1%. Treat a weekday drop toward 1.7% as seasonal only if page-load mix matches Sunday
docs.search.query on project develop-docs, environment production	156 events in 24h. 1513 page loads. About 10.3% of loads	2026-10-25T20:04:21Z to 2026-10-26T20:04:21Z	Sentry org sentry, project develop-docs, metric docs.search.query	Hold. Absent if this counter stays near zero while develop-docs page loads hold

Regression watch

A throw in search result render fails first for users. Watch JavaScript errors on the search stack. Existing Algolia insights fetch failures from search index.tsx are known noise. Do not treat that title as this sanitizer failing.

Signal	Baseline	Window	Source	Rule
Production JavaScript errors on project docs with stack filename matching search or DOMPurify	20 events in 24h. About 1.4% of 1471 search queries. Sampled events were TypeError Failed to fetch to insights.algolia.io	2026-10-25T20:04:21Z to 2026-10-26T20:04:21Z	Sentry org sentry, project docs, environment production, platform javascript, stack.filename search or DOMPurify	Hold near 1.4% of search queries. Detected if the share doubles, or if a new title cites searchResultItems or DOMPurify
Production errors on project docs whose message cites DOMPurify, searchResultItems, or sanitize	0 events in 24h	2026-10-25T20:04:21Z to 2026-10-26T20:04:21Z	Sentry org sentry, project docs, environment production	Hold at 0. Any new event is detected
Production JavaScript errors on project develop-docs	24 events in 24h. About 1.6% of 1513 page loads	2026-10-25T20:04:21Z to 2026-10-26T20:04:21Z	Sentry org sentry, project develop-docs, environment production, platform javascript	Hold near 1.6% of page loads. Detected if the share doubles

If search-path errors rise, inspect frames in searchResultItems and DOMPurify first.

Not observable

Sanitized hit HTML is not measured. Blank titles after over-stripping would not change docs.search.query. XSS that never throws is not in the error stream. Project docs-csp has no production environment tag, so CSP volume for injected search HTML was not confirmed. The prior 24h count for docs search-stack errors was not measured. develop-docs search-stack errors were not sliced from the 24 JavaScript errors.