Vendored swagger-ui bundles DOMPurify 3.2.6 (CVE-2026-65898 fixed in 3.4.11) — please refresh the admin UI assets

Summary

The admin UI assets vendored in both org.wiremock:wiremock:3.13.2 and org.wiremock:wiremock-standalone:3.13.2 (assets/swagger-ui/) embed swagger-ui-dist 5.30.2, whose bundles carry DOMPurify 3.2.6:

$ unzip -p wiremock-standalone-3.13.2.jar \
    assets/swagger-ui/swagger-ui-dist/swagger-ui-bundle.js | grep -o 'DOMPurify.version="[0-9.]*"'
DOMPurify.version="3.2.6"

DOMPurify ≤ 3.4.10 is affected by CVE-2026-65898 (GHSA-cmwh-pvxp-8882, fixed in 3.4.11), among newer advisories. Security scanners (OWASP Dependency-Check / RetireJS) therefore flag every project embedding WireMock, and no released WireMock version helps:

• the stable line stops at 3.13.2;
• 4.0.0-beta.38 actually bundles an older DOMPurify (3.1.4, via swagger-ui 5.17.14);
• the thin wiremock artifact carries the same assets, so switching artifacts does not remove them.

Ask

Please refresh the vendored swagger-ui to a release embedding DOMPurify ≥ 3.4.11 in the next 3.x patch (and in the 4.x line).