DOMPurify 3.4.13-3.4.15 can leave event handlers armed on a detached subtree
when IN_PLACE sanitizing is combined with a node-removing afterSanitize hook
(GHSA-p98j-92pf-mc4p, low). The message sanitizer uses neither (only an
afterSanitizeAttributes hook), so it isn't believed affected, but the fix is
a patch release. Typecheck, tests and build pass.
jcoffey-dev