fix(dev-server-ui): update dompurify and uuid for security advisories

[nieblara]

Requirements

• I have added test coverage for new or changed functionality. Not applicable. This change updates only dependencies.
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

This PR gives only the security fixes that the Dependabot group PR #779 names: dompurify and uuid. PR #779 also updates @launchpad-ui/components to 0.23, react-router to 8, vite to 8, and launchdarkly-js-client-sdk to 3.9.5. Its description does not name these updates. With them, npm ci fails on React 19 peer dependencies. This PR does not include these updates. PRs #740 and #777 used the same focused approach.

This PR does not close #779.

Describe the solution you've provided

Both packages are transitive dependencies of the dev server UI (internal/dev_server/ui).

Package	Path	Old	New	How
dompurify	@launchpad-ui/core → @launchpad-ui/markdown → isomorphic-dompurify (^3.1.6)	3.2.4	3.4.16	Lockfile only
uuid	launchdarkly-js-client-sdk 3.4.0 → launchdarkly-js-sdk-common 5.3.0 (^8.0.0)	8.3.2	11.1.1	Scoped npm override

The dompurify range ^3.1.6 already allows 3.4.16, so no override is necessary for dompurify. The uuid range ^8.0.0 does not allow a patched version. The only other fix is to update the JS SDK, which is out of scope. Thus, the PR adds this scoped override in package.json:

"launchdarkly-js-sdk-common": { "uuid": "11.1.1" }

launchdarkly-js-sdk-common calls only v1() from uuid, with no buffer argument. uuid 11 exports v1 for require. A local check loaded the module with uuid 11.1.1 and it worked.

The lockfile diff changes only the dompurify and uuid entries.

Advisories that this PR fixes:

• uuid: GHSA-w5hq-g745-h8pq (moderate, patched in 11.1.1)
• dompurify, moderate: GHSA-v8jm-5vwx-cfxm, GHSA-v2wj-7wpq-c8vv, GHSA-h8r8-wccr-v5f2, GHSA-cjmm-f4jc-qw8r, GHSA-cj63-jhhr-wcxv, GHSA-39q2-94rc-95cp, GHSA-h7mw-gpvr-xq4m, GHSA-crv5-9vww-q3g8, GHSA-v9jr-rg53-9pgp, GHSA-hpcv-96wg-7vj8, GHSA-r47g-fvhr-h676, GHSA-76mc-f452-cxcm, GHSA-rp9w-3fw7-7cwq, GHSA-cmwh-pvxp-8882, GHSA-55q2-fjhq-7xh7
• dompurify, low: GHSA-gvmj-g25r-r7wr, GHSA-vxr8-fq34-vvx9, GHSA-x4vx-rjvf-j5p4, GHSA-c2j3-45gr-mqc4, GHSA-6688-9rhm-gjv2

PR #779 uses dompurify 3.4.13. GitHub published GHSA-6688-9rhm-gjv2 on Oct 5, 2026, after #779 opened. That advisory needs 3.4.16. Thus, 3.4.16 is the lowest version that clears all dompurify advisories.

npm audit in internal/dev_server/ui:

	Low	Moderate	High	Critical	Total
Before (all dependencies)	1	10	14	2	27
After (all dependencies)	1	6	14	2	23
Before (--omit=dev)	0	8	0	0	8
After (--omit=dev)	0	4	0	0	4

The audit removed dompurify, uuid, launchdarkly-js-sdk-common, and launchdarkly-js-client-sdk from the report. The audit found no new advisories. The other findings were on main before this change, and this PR does not touch them.

Local checks in internal/dev_server/ui, with Node 22 and npm 10.9:

• npm ci: pass
• npm run lint: pass
• npm run prettier:write: no changes
• npm test: 5 tests pass
• npm run build: pass. The committed dist/ did not change.

Describe alternatives you've considered

• Merge chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #779. This fails npm ci and adds new high advisories.
• Update launchdarkly-js-client-sdk to 3.9.2 or later, which removes uuid. This is out of scope for this PR.
• Use dompurify 3.4.13, the version in chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #779. This leaves GHSA-6688-9rhm-gjv2 open.

Additional context

The built dist/index.html did not change. The UI does not import @launchpad-ui/markdown, so the bundle does not contain dompurify. The prebuilt launchdarkly-js-client-sdk bundle contains its own copy of uuid 8 code. Thus, this PR clears the advisories from the installed dependency tree, but the shipped UI code stays the same. The SDK uses only uuid v1() without a buffer, so GHSA-w5hq-g745-h8pq does not apply to that code.

PR #880 also changes this lockfile. If a conflict occurs, rebase on main and regenerate the lockfile.