fix: upgrade dompurify from 2.2.2 to 2.2.6

[sy-records]

Replace #1470

[vercel]

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/docsify-core/docsify-preview/l6tfu5hbe
✅ Preview: https://docsify-preview-git-fork-sy-records-dompurify.docsify-core.now.sh

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit ed7fa16:

Sandbox	Source
docsify-template	Configuration

[Koooooo-7]

it seems there has the security/snyk issue on CI.
@anikethsaha could u plz check and fix it intead of manual upgrade？

[anikethsaha]

Not sure whether I get this correctly but you are asking for a PR from snyk ? @Koooooo-7

[Koooooo-7]

Not sure whether I get this correctly but you are asking for a PR from snyk ? @Koooooo-7

yup, the PR of snyk always deletes the dependencies about vue in package-lock.json. f.e see #1470 .

[Koooooo-7]

I guess we need move the vue from devDependencies to dependencies .

[sy-records]

The reason I closed #1470 was because it was out of date, 4 versions behind

[sy-records]

Maybe snyk doesn't recognize this style

https://github.com/docsifyjs/docsify/blob/develop/package.json#L106-L107

[jhildenbiddle]

Maybe snyk doesn't recognize this style

https://github.com/docsifyjs/docsify/blob/develop/package.json#L106-L107

@sy-records -- Let's ping Snyk and let them know that their system appears unable to determine when two versions of the same library are listed as dependencies. Otherwise we're just going to run into this issue over and over again. Sounds like @anikethsaha maintains our account?

[anikethsaha]

Maybe snyk doesn't recognize this style
https://github.com/docsifyjs/docsify/blob/develop/package.json#L106-L107

@sy-records -- Let's ping Snyk and let them know that their system appears unable to determine when two versions of the same library are listed as dependencies. Otherwise we're just going to run into this issue over and over again. Sounds like @anikethsaha maintains our account?

I think @sy-records does have the access, right ?
if not please tell me how to give access, I tried but it wasnt successfull.

[sy-records]

I private messaged you in discord @anikethsaha