[brionmario]

Purpose

Clears three new advisories that fail the Security Audit step of seven JavaScript samples, on every pull request:

Advisory	Severity	Package	Samples
GHSA-cg2g-xh64-v4q7	critical	dompurify 3.4.13	b2b/manage, self-care/account, quickstarts/{nextjs,nuxt,react,vue}
GHSA-mrv2-3pqr-j5jr	high	dompurify 3.4.13	the same six
GHSA-27r3-jxmh-p828	high	body-parser 1.20.8	quickstarts/express

Approach

• dompurify: the pinned @thunderid/react and @thunderid/vue releases depend on exactly dompurify 3.4.13, so a lockfile refresh can't move it. Each of the six samples gets an npm overrides entry for 3.4.17, the patched version, which is the samples' convention for a pinned transitive version. The current SDK releases (@thunderid/react and @thunderid/vue 1.6.0) already ship 3.4.17, so the override can go when a sample moves to one of them.
• body-parser: 1.20.9 is within express's own ~1.20.5 range, so only the express quickstart's lockfile changes.

Every lockfile change is the patched version alone. No advisory is added to AUDIT_ALLOWED_GHSAS.

Locally, each of the seven samples passes the same steps as the PR builder: npm ci, the audit check, and format:check, lint and build where defined.

Related PRs

• Move the Android quickstart to Android SDK v1.6.0 #14 (fails on these advisories too, and passes once this merges)

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.