From 44411ec165cdab055df37a45596c505af1f21d11 Mon Sep 17 00:00:00 2001
From: John Cardinal <support@ayanova.com>
Date: Sat, 24 Oct 2026 18:06:28 -0700
Subject: [PATCH] case 4722 - DOMPurify 2.5.9 and Vuetify 2.7.2

DOMPurify 2.3.8 -> 2.5.9 and Vuetify 2.6.6 -> 2.7.2, the latest 2.x of
each; builds on Node 12.22.9. Only these two packages change in the
lockfile (kept in its v2 format).

Vuetify 2.7 calendar eventSummary() returns an element, not an HTML
string, so the six calendar event templates render it with the new
gz-vnodes component instead of v-html.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ayanova/package-lock.json                     | 28 +++++++++----------
 ayanova/package.json                          |  4 +--
 .../src/components/dash-today-reminders.vue   |  8 ++----
 ayanova/src/components/dash-today-reviews.vue |  8 ++----
 .../components/dash-today-scheduled-wo.vue    |  8 ++----
 ayanova/src/components/vnodes-control.vue     | 11 ++++++++
 ayanova/src/main.js                           |  2 ++
 ayanova/src/views/home-schedule.vue           |  8 ++----
 ayanova/src/views/svc-schedule-user.vue       |  8 ++----
 ayanova/src/views/svc-schedule.vue            |  5 ++--
 10 files changed, 47 insertions(+), 43 deletions(-)
 create mode 100644 ayanova/src/components/vnodes-control.vue

diff --git a/ayanova/package-lock.json b/ayanova/package-lock.json
index 77321919..83081449 100644
--- a/ayanova/package-lock.json
+++ b/ayanova/package-lock.json
@@ -15,7 +15,7 @@
         "chart.js": "^2.9.4",
         "chartjs-adapter-luxon": "^0.2.2",
         "core-js": "^3.23.1",
-        "dompurify": "^2.3.8",
+        "dompurify": "^2.5.9",
         "fontsource-roboto": "^3.1.5",
         "github-markdown-css": "^4.0.0",
         "jwt-decode": "^3.1.2",
@@ -31,7 +31,7 @@
         "vue-currency-input": "1.22.3",
         "vue-router": "^3.5.4",
         "vue-signature": "^2.5.5",
-        "vuetify": "^2.6.6",
+        "vuetify": "^2.7.2",
         "vuex": "^3.6.2",
         "vuex-persistedstate": "^2.7.1"
       },
@@ -6190,9 +6190,9 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.3.8.tgz",
-      "integrity": "sha512-eVhaWoVibIzqdGYjwsBWodIQIaXFSB+cKDf4cfxLMsK0xiud6SE+/WCVx/Xw/UwQsa4cS3T2eITcdtmTg2UKcw=="
+      "version": "2.5.9",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.5.9.tgz",
+      "integrity": "sha512-i6mvVmWN4xo9LrhCOZrDgSs9noW6nOahbrmzjRbPF36YPyj5Ue5lgok0MHDWkG7xzpWFO2OYttXdzM7rJxHvNA=="
     },
     "node_modules/domutils": {
       "version": "2.8.0",
@@ -15398,9 +15398,9 @@
       "dev": true
     },
     "node_modules/vuetify": {
-      "version": "2.6.6",
-      "resolved": "https://registry.npmjs.org/vuetify/-/vuetify-2.6.6.tgz",
-      "integrity": "sha512-H4KtxDFmDN8QiTRiGfBySyjMhVaHAJTKB0llGGKZT5jKxtnx9gvEtMWXKtVuRP0NJJP0H6xBPJHNOH7nT18qiQ==",
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/vuetify/-/vuetify-2.7.2.tgz",
+      "integrity": "sha512-qr04ww7uzAPQbpk751x4fSdjsJ+zREzjQ/rBlcQGuWS6MIMFMXcXcwvp4+/tnGsULZxPMWfQ0kmZmg5Yc/XzgQ==",
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/johnleider"
@@ -21772,9 +21772,9 @@
       }
     },
     "dompurify": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.3.8.tgz",
-      "integrity": "sha512-eVhaWoVibIzqdGYjwsBWodIQIaXFSB+cKDf4cfxLMsK0xiud6SE+/WCVx/Xw/UwQsa4cS3T2eITcdtmTg2UKcw=="
+      "version": "2.5.9",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.5.9.tgz",
+      "integrity": "sha512-i6mvVmWN4xo9LrhCOZrDgSs9noW6nOahbrmzjRbPF36YPyj5Ue5lgok0MHDWkG7xzpWFO2OYttXdzM7rJxHvNA=="
     },
     "domutils": {
       "version": "2.8.0",
@@ -29104,9 +29104,9 @@
       "dev": true
     },
     "vuetify": {
-      "version": "2.6.6",
-      "resolved": "https://registry.npmjs.org/vuetify/-/vuetify-2.6.6.tgz",
-      "integrity": "sha512-H4KtxDFmDN8QiTRiGfBySyjMhVaHAJTKB0llGGKZT5jKxtnx9gvEtMWXKtVuRP0NJJP0H6xBPJHNOH7nT18qiQ==",
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/vuetify/-/vuetify-2.7.2.tgz",
+      "integrity": "sha512-qr04ww7uzAPQbpk751x4fSdjsJ+zREzjQ/rBlcQGuWS6MIMFMXcXcwvp4+/tnGsULZxPMWfQ0kmZmg5Yc/XzgQ==",
       "requires": {}
     },
     "vuetify-loader": {
diff --git a/ayanova/package.json b/ayanova/package.json
index 598a2b15..24fd16e5 100644
--- a/ayanova/package.json
+++ b/ayanova/package.json
@@ -16,7 +16,7 @@
     "chart.js": "^2.9.4",
     "chartjs-adapter-luxon": "^0.2.2",
     "core-js": "^3.23.1",
-    "dompurify": "^2.3.8",
+    "dompurify": "^2.5.9",
     "fontsource-roboto": "^3.1.5",
     "github-markdown-css": "^4.0.0",
     "jwt-decode": "^3.1.2",
@@ -32,7 +32,7 @@
     "vue-currency-input": "1.22.3",
     "vue-router": "^3.5.4",
     "vue-signature": "^2.5.5",
-    "vuetify": "^2.6.6",
+    "vuetify": "^2.7.2",
     "vuex": "^3.6.2",
     "vuex-persistedstate": "^2.7.1"
   },
diff --git a/ayanova/src/components/dash-today-reminders.vue b/ayanova/src/components/dash-today-reminders.vue
index ef3328c5..f39a35e4 100644
--- a/ayanova/src/components/dash-today-reminders.vue
+++ b/ayanova/src/components/dash-today-reminders.vue
@@ -26,11 +26,9 @@
         >
           <template v-slot:event="{ event, eventSummary }">
             <div>
-              <!-- eslint-disable vue/no-v-html -->
-              <span
-                :class="event.textColor + '--text'"
-                v-html="eventSummary()"
-              /><v-icon v-if="!event.editable" x-small :color="event.textColor">
+              <span :class="event.textColor + '--text'"
+                ><gz-vnodes :vnodes="eventSummary()"/></span
+              ><v-icon v-if="!event.editable" x-small :color="event.textColor">
                 $ayiLock</v-icon
               >
             </div>
diff --git a/ayanova/src/components/dash-today-reviews.vue b/ayanova/src/components/dash-today-reviews.vue
index f22b5c23..b0b29f7b 100644
--- a/ayanova/src/components/dash-today-reviews.vue
+++ b/ayanova/src/components/dash-today-reviews.vue
@@ -25,11 +25,9 @@
         >
           <template v-slot:event="{ event, eventSummary }">
             <div>
-              <!-- eslint-disable vue/no-v-html -->
-              <span
-                :class="event.textColor + '--text'"
-                v-html="eventSummary()"
-              /><v-icon v-if="!event.editable" x-small :color="event.textColor">
+              <span :class="event.textColor + '--text'"
+                ><gz-vnodes :vnodes="eventSummary()"/></span
+              ><v-icon v-if="!event.editable" x-small :color="event.textColor">
                 $ayiLock</v-icon
               >
             </div>
diff --git a/ayanova/src/components/dash-today-scheduled-wo.vue b/ayanova/src/components/dash-today-scheduled-wo.vue
index e67c981b..7c454278 100644
--- a/ayanova/src/components/dash-today-scheduled-wo.vue
+++ b/ayanova/src/components/dash-today-scheduled-wo.vue
@@ -26,11 +26,9 @@
         >
           <template v-slot:event="{ event, eventSummary }">
             <div>
-              <!-- eslint-disable vue/no-v-html -->
-              <span
-                :class="event.textColor + '--text'"
-                v-html="eventSummary()"
-              /><v-icon v-if="!event.editable" x-small :color="event.textColor">
+              <span :class="event.textColor + '--text'"
+                ><gz-vnodes :vnodes="eventSummary()"/></span
+              ><v-icon v-if="!event.editable" x-small :color="event.textColor">
                 $ayiLock</v-icon
               >
             </div>
diff --git a/ayanova/src/components/vnodes-control.vue b/ayanova/src/components/vnodes-control.vue
new file mode 100644
index 00000000..57586071
--- /dev/null
+++ b/ayanova/src/components/vnodes-control.vue
@@ -0,0 +1,11 @@
+<script>
+//case 4722: renders the element(s) passed in vnodes
+//(Vuetify 2.7 calendar eventSummary() returns an element, not an HTML string)
+export default {
+  functional: true,
+  props: {
+    vnodes: { type: [Object, Array], default: null }
+  },
+  render: (h, ctx) => ctx.props.vnodes
+};
+</script>
diff --git a/ayanova/src/main.js b/ayanova/src/main.js
index e00b5f4f..4296c028 100644
--- a/ayanova/src/main.js
+++ b/ayanova/src/main.js
@@ -59,6 +59,7 @@ import attachmentControl from "./components/attachment-control.vue";
 import chartLineControl from "./components/chart-line-control.vue";
 import chartBarControl from "./components/chart-bar-control.vue";
 import chartBarHorizontalControl from "./components/chart-bar-horizontal-control.vue";
+import vnodesControl from "./components/vnodes-control.vue";
 
 /////////////////////////////////////////////////////////////////
 // LIBS AND GLOBAL ITEMS
@@ -180,6 +181,7 @@ Vue.component("gz-attachments", attachmentControl);
 Vue.component("gz-chart-line", chartLineControl);
 Vue.component("gz-chart-bar", chartBarControl);
 Vue.component("gz-chart-bar-horizontal", chartBarHorizontalControl);
+Vue.component("gz-vnodes", vnodesControl);
 //3rd party components
 Vue.use(VueCurrencyInput);
 /////////////////////////////////////////////////////////////
diff --git a/ayanova/src/views/home-schedule.vue b/ayanova/src/views/home-schedule.vue
index fb2ea829..b37dce4e 100644
--- a/ayanova/src/views/home-schedule.vue
+++ b/ayanova/src/views/home-schedule.vue
@@ -103,11 +103,9 @@
             <v-icon small :color="event.textColor" class="mt-n3 mr-1">{{
               iconForEvent(event.type)
             }}</v-icon>
-            <!-- eslint-disable vue/no-v-html -->
-            <span
-              :class="event.textColor + '--text'"
-              v-html="eventSummary()"
-            /><v-icon
+            <span :class="event.textColor + '--text'"
+              ><gz-vnodes :vnodes="eventSummary()"/></span
+            ><v-icon
               v-if="!event.editable"
               x-small
               :color="event.textColor"
diff --git a/ayanova/src/views/svc-schedule-user.vue b/ayanova/src/views/svc-schedule-user.vue
index 1bd7a11c..4baab95b 100644
--- a/ayanova/src/views/svc-schedule-user.vue
+++ b/ayanova/src/views/svc-schedule-user.vue
@@ -96,11 +96,9 @@
             <v-icon small :color="event.textColor" class="mr-1">{{
               iconForEvent(event.type)
             }}</v-icon>
-            <!-- eslint-disable vue/no-v-html -->
-            <span
-              :class="event.textColor + '--text'"
-              v-html="eventSummary()"
-            /><v-icon
+            <span :class="event.textColor + '--text'"
+              ><gz-vnodes :vnodes="eventSummary()"/></span
+            ><v-icon
               v-if="!event.editable"
               x-small
               :color="event.textColor"
diff --git a/ayanova/src/views/svc-schedule.vue b/ayanova/src/views/svc-schedule.vue
index 5eb41ec1..36dba4ef 100644
--- a/ayanova/src/views/svc-schedule.vue
+++ b/ayanova/src/views/svc-schedule.vue
@@ -132,8 +132,9 @@
 
         <template v-slot:event="{ event, eventSummary }">
           <div class="v-event-draggable">
-            <!-- eslint-disable vue/no-v-html -->
-            <span :class="event.textColor + '--text'" v-html="eventSummary()" />
+            <span :class="event.textColor + '--text'"
+              ><gz-vnodes :vnodes="eventSummary()"
+            /></span>
             <v-icon
               v-if="!event.editable"
               x-small