Update frontend dependencies (DOMPurify XSS fixes, Vite 7, Node 22)

.nvmrc

@@ -1 +1 @@
-20.15.1
+22

Dockerfile

@@ -17,7 +17,7 @@ RUN pip install --no-cache-dir -r requirements/dev.txt
 RUN mkdir /usr/local/.nvm
 ENV NVM_DIR /usr/local/.nvm
 # This should match the version referenced below in the Run stage, and in entrypoint.sh
-ENV NODE_VERSION 20.15.1
+ENV NODE_VERSION 22.21.0
 
 COPY package.json package-lock.json /app/
 
@@ -43,7 +43,7 @@ COPY --from=builder /usr/local/.nvm /usr/local/.nvm
 ENV NVM_DIR /usr/local/.nvm
 
 # The version in this path should match the version referenced above in the Run stage, and in entrypoint.sh
-ENV PATH $NVM_DIR/versions/node/v20.15.1/bin:$PATH
+ENV PATH $NVM_DIR/versions/node/v22.21.0/bin:$PATH
 
 COPY --from=builder /app/node_modules /app/node_modules
 

HISTORY.rst

@@ -7,6 +7,9 @@ This project adheres to `Semantic Versioning <https://semver.org/>`_.
 
 Unreleased
 ===========================
+* Frontend dependencies updated to clear ``npm audit`` advisories, including DOMPurify 3.4 (XSS fixes; used to
+  sanitize AI Assistant output), Vite 7, and current Sass. Building the frontend now requires Node 22.
+
 * `#713`_: Connections whose database driver isn't installed (e.g. MySQL without ``mysqlclient``) can no longer be
   saved, and are marked "(driver not installed)" in the engine dropdown. Existing ones, and unreachable databases, now
   show a readable error in the schema pane, Test connection, and query runs instead of a 500.

entrypoint.sh

@@ -6,7 +6,7 @@ set -e
 # Source the nvm script to set up the environment
 # This should match the version referenced in Dockerfile
 . /usr/local/.nvm/nvm.sh
-nvm use 20.15.1
+nvm use 22.21.0
 
 # Django
 python manage.py migrate