auth0-lock depends on vulnerable versions of dompurify

[jacekkoziol]

Checklist

• I have looked into the Readme and Examples, and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

# npm audit report

dompurify  <3.2.4
Severity: moderate
DOMPurify allows Cross-site Scripting (XSS) - https://github.com/advisories/GHSA-vhxf-7vqr-mrjg
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/dompurify
  auth0-lock  >=11.30.1
  Depends on vulnerable versions of dompurify
  node_modules/auth0-lock

2 moderate severity vulnerabilities

Reproduction

1. npm i auth0-lock
2. npm audit

Additional context

No response

Lock version

13.0.0

Which browsers have you tested in?

Chrome