See Advisory: https://github.com/advisories/GHSA-h8r8-wccr-v5f2
It's an issue affecting DOMPurify versions before 3.3.2. All uses in Tuleap production code are set to version 3.3.2 (since request #47162), except for one use in slides for documentation. Tuleap itself is not affected by this issue.
For the remaining use in slides, the version cannot be upgraded, as DOMPurify is bundled within monaco-editor, so we choose to temporarily ignore it.