fix(deps): clear the open dependency security alerts

.changeset/dompurify-minimum.md

@@ -0,0 +1,7 @@
+---
+"@matdata/yasgui": patch
+"@matdata/yasr": patch
+"@matdata/yasgui-utils": patch
+---
+
+Require DOMPurify 3.4.17 or later, so installs never resolve a version with the published DOMPurify advisories. Packages now depend on the matching version of each other (`@matdata/yasqe`, `@matdata/yasr`, `@matdata/yasgui-utils`) instead of the 4.x line.

.github/workflows/publish.yml

@@ -1,57 +1,76 @@
-name: Publish to npm
-
-on:
-  release:
-    types: [published]
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: '24'
-          check-latest: true
-          registry-url: 'https://registry.npmjs.org'
-          package-manager-cache: false  # never use caching in release builds
-
-      - name: Install dependencies
-        run: npm ci
-        env:
-          PUPPETEER_SKIP_DOWNLOAD: 1
-
-      - name: Update package versions from release tag
-        run: |
-          TAG_VERSION=${GITHUB_REF#refs/tags/}
-          TAG_VERSION=${TAG_VERSION#v}
-          echo "Updating all packages to version $TAG_VERSION"
-
-          # Update each package version
-          for package_dir in packages/*/; do
-            if [ -f "${package_dir}package.json" ]; then
-              echo "Updating version in ${package_dir}package.json"
-              cd "$package_dir"
-              npm version $TAG_VERSION --no-git-tag-version --allow-same-version
-              cd ../..
-            fi
-          done
-
-      - name: Build
-        run: npm run build
-
-      - name: Copy README to packages
-        run: |
-          for dir in packages/*/; do
-            [ -f "${dir}package.json" ] && cp README.md "${dir}README.md"
-          done
-
-      - name: Publish to npm
-        run: npx changeset publish --no-git-tag
-        env:
+name: Publish to npm
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          check-latest: true
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false  # never use caching in release builds
+
+      - name: Install dependencies
+        run: npm ci
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: 1
+
+      - name: Update package versions from release tag
+        run: |
+          TAG_VERSION=${GITHUB_REF#refs/tags/}
+          TAG_VERSION=${TAG_VERSION#v}
+          echo "Updating all packages to version $TAG_VERSION"
+
+          # Update each package version
+          for package_dir in packages/*/; do
+            if [ -f "${package_dir}package.json" ]; then
+              echo "Updating version in ${package_dir}package.json"
+              cd "$package_dir"
+              npm version $TAG_VERSION --no-git-tag-version --allow-same-version
+              cd ../..
+            fi
+          done
+
+          # Point the packages at each other's new version, so consumers of
+          # @matdata/yasgui don't install the stale 4.x yasqe/yasr/utils
+          node -e '
+            const fs = require("fs");
+            const v = process.argv[1];
+            const dirs = fs.readdirSync("packages").filter((d) => fs.existsSync(`packages/${d}/package.json`));
+            const names = dirs.map((d) => require(`./packages/${d}/package.json`).name);
+            for (const d of dirs) {
+              const file = `packages/${d}/package.json`;
+              const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+              for (const field of ["dependencies", "peerDependencies", "devDependencies"]) {
+                for (const name of Object.keys(pkg[field] || {})) {
+                  if (names.includes(name)) pkg[field][name] = `^${v}`;
+                }
+              }
+              fs.writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n");
+            }
+          ' "$TAG_VERSION"
+
+      - name: Build
+        run: npm run build
+
+      - name: Copy README to packages
+        run: |
+          for dir in packages/*/; do
+            [ -f "${dir}package.json" ] && cp README.md "${dir}README.md"
+          done
+
+      - name: Publish to npm
+        run: npx changeset publish --no-git-tag
+        env:
           NPM_CONFIG_PROVENANCE: true