[Aikido] Fix 5 security issues in @tiptap/core, dompurify

[aikido-autofix]

Upgrade @tiptap/core and dompurify to fix prototype pollution XSS and event handler execution vulnerabilities in sanitization.

⚠️ Breaking changes analysis not available for: @tiptap/core

✅ No breaking changes for: dompurify

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-613639	HIGH	[@tiptap/core] The mergeAttributes() helper is vulnerable to prototype pollution via untrusted attribute objects, allowing attackers to inject malicious DOM attributes through XSS when content is serialized as ProseMirror output.
AIKIDO-2026-65180	HIGH	[@tiptap/core] A prototype pollution vulnerability in the mergeAttributes() helper allows attackers to inject malicious properties into object prototypes via __proto__ keys in document data, leading to arbitrary JavaScript execution when attributes are rendered in the DOM.
GHSA-55q2-fjhq-7xh7	MEDIUM	[dompurify] A hook-based element removal during IN_PLACE sanitization can leave detached descendants with executable event handlers, allowing an attacker-provided onload handler to fire after sanitization completes. This enables XSS execution in applications using IN_PLACE mode with element-removal hooks.
AIKIDO-2026-404587	LOW	[dompurify] A mutation XSS vulnerability allows bypassing sanitization through literal-text elements (style, xmp, noembed, noframes, noscript) and uppercase attribute names that survive filtering and become executable after serialization and reparsing. This enables attackers to inject malicious scripts when these risky tags are allow-listed or attributes aren't properly removed by case-sensitive matching.
AIKIDO-2026-925458	LOW	[dompurify] A vulnerability allows event handlers to persist in detached DOM nodes when sanitization hooks remove containing elements with the IN_PLACE option enabled, enabling arbitrary code execution after sanitization completes when pending resource events fire.

🤖 Remediation details

Fix security vulnerabilities in @tiptap/core and dompurify

Both vulnerable packages are declared as direct dependencies in ui/vuetifyx/vuetifyxjs/package.json. Bumping their declared version ranges and running pnpm install --lockfile-only was sufficient to resolve all affected instances in pnpm-lock.yaml. No overrides were required.

@tiptap/core

@tiptap/core was declared at ^3.30.2 and resolved to 3.30.2, which falls within the vulnerable range >=2.0.0 <=3.30.3. The declared specifier in package.json was raised to ^3.30.4 (the patched floor), causing pnpm to resolve the package to 3.30.6 in the lockfile. The sibling package @tiptap/vue-3 was declared at the same ^3.30.2 range and moved to ^3.30.4 in the same edit, as both belong to the same tiptap release group and share a version range by design.

dompurify

dompurify was declared at ^3.4.12 and resolved to 3.4.12, which is below the patched floor of 3.4.14. The declared specifier in package.json was raised to ^3.4.14, and pnpm resolved the package to 3.4.14 in the lockfile, clearing all three advisories that targeted this package.

Version changes

Package	From	To	Why updated
@tiptap/core	^3.30.2 (resolved 3.30.2)	^3.30.4 (resolved 3.30.6)	Direct CVE fix
@tiptap/vue-3	^3.30.2 (resolved 3.30.2)	^3.30.4 (resolved 3.30.6)	Sibling group alignment with @tiptap/core
dompurify	^3.4.12 (resolved 3.4.12)	^3.4.14 (resolved 3.4.14)	Direct CVE fix