Bootstrap/DOMPurify out of date on Inventory

[SueValente]

See security scan from ISSO:

<style> </style>

Out-of-date Version (Bootstrap)	Medium	Scan-Q,Q-Data	Q-Data - https://inventory.data.gov/ - Production	https://inventory.data.gov/dataset/
Out-of-date Version (Bootstrap)	Medium	Scan-Q,Q-Data	Q-Data - https://inventory-dev-datagov.app.cloud.gov/ - Development	https://inventory-dev-datagov.app.cloud.gov/dataset/
Out-of-date Version (Bootstrap)	Medium	Scan-Q,Q-Data	Q-Data - https://inventory-stage-datagov.app.cloud.gov/ - Staging	https://inventory-stage-datagov.app.cloud.gov/dataset/
Out-of-date Version (DOMPurify)	Medium	Scan-Q,Q-Data	Q-Data - https://inventory-stage-datagov.app.cloud.gov/ - Staging	https://inventory-stage-datagov.app.cloud.gov/dataset/
Out-of-date Version (DOMPurify)	Medium	Scan-Q,Q-Data	Q-Data - https://inventory.data.gov/ - Production	https://inventory.data.gov/dataset/
Out-of-date Version (DOMPurify)	Medium	Scan-Q,Q-Data	Q-Data - https://inventory-dev-datagov.app.cloud.gov/ - Development	https://inventory-dev-datagov.app.cloud.gov/dataset/

[SueValente]

need to keep as high priority, flag as false positive, close it.
Send Sue results

[FuhuXia]

Out-of-date Version (Bootstrap) is false positive.
The latest stable release is 5.3.8. Inventory is on 5.1.3. It is not using the latest but there is vulnerabiltuy in 5.1.3. The finding should not have a Medium Severity. The severity should be Info, no fix needed.
https://security.snyk.io/package/npm/bootstrap/versions?page=1

[FuhuXia]

Out-of-date Version (DOMPurify) has been fixed in PR

• update ckan to upgrade dompurify inventory-app#936

Inventory is on DOMPurify version 3.4.11