Findings No. 23
Vendored copies of a dependency's security data need a drift test
A vendored copy of DOMPurify's html profile is frozen while the dependency moves. A test that diffs the installed package's own lists against the vendored copy turns silent divergence into a loud failure.
Vendoring a copy of a dependency's security data creates a quiet liability: the copy is frozen and the dependency is not. Woof Editor vendors DOMPurify's html-profile tag and attribute lists (the pin that keeps a partial sanitize schema from widening, see Findings No. 20), which means a future DOMPurify release could change the real profile while the vendored copy silently stays put.
The mitigation is a drift test: at test time, read the installed DOMPurify's own source lists and diff its html profile against the vendored copies. On any difference the test fails loudly, printing the differing entries and the installed version, turning a silent divergence into a one-line fix with a changelog entry.
The general rule: a vendored copy of security-relevant data needs an automated comparison against its source of truth, in the test suite, keyed to whatever version is actually installed.
Receipt: woof-editor CHANGELOG 0.2.1; src/lib/utils/sanitize-drift.test.ts.