Bump sanitize-html from 2.17.4 to 2.17.6

CLAUDE.md

@@ -8,6 +8,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Notes on dependencies
 - The root `package.json` `overrides` for `qs` exists because Netlify's npm mirror lagged behind npmjs.org for a freshly published patch (`qs@6.15.2`, May 2026) and `npm ci` failed with `ETARGET`. Safe to remove once you can confirm Netlify deploys without it.
+- `sanitize-html` >=2.17.6 pulls in `htmlparser2@12`, which dropped its CommonJS build (pure ESM, no `require` export condition). Node 22.12+/24 handles this fine via native `require(esm)`, so the app runs unaffected, but Jest's own module system can't parse it, so backend tests mock `sanitize-html` — see `packages/backend/src/__mocks__/sanitize-html.js` (auto-applied by Jest's node-module manual-mock convention, no config wiring needed). Do **not** "fix" this by downgrading/overriding `htmlparser2` — the 2.17.6 bump is a real XSS security patch (GHSA-jxwj-j7wr-gfrw) and the htmlparser2 upgrade is part of it. Upstream tracked the Jest/ESM friction at apostrophecms/apostrophe#5526 and closed it with no fix — they consider it expected, not a bug in their library.
 
 ## Commands
 

packages/backend/package.json

@@ -47,7 +47,7 @@
     "pg-boss": "^8.0.0",
     "pg-cursor": "^2.21.0",
     "qs": "^6.15.2",
-    "sanitize-html": "^2.13.1",
+    "sanitize-html": "^2.17.6",
     "socket.io": "^4.7.5",
     "swagger-jsdoc": "^6.2.8",
     "swagger-ui-express": "^5.0.1"

packages/backend/src/__mocks__/sanitize-html.js

@@ -0,0 +1,18 @@
+// Jest-only stand-in for `sanitize-html`. The real package pulls in htmlparser2@12,
+// which dropped its CommonJS build (ESM-only) and can't be parsed by Jest's module
+// system, even though Node itself handles it fine via native require(esm) support.
+// See CLAUDE.md "Notes on dependencies" for the full story.
+//
+// No test in this repo asserts on actual sanitization output, so this passthrough
+// is sufficient here. The real, security-patched sanitize-html is still what runs
+// in dev/prod — this mock only takes effect under Jest.
+function sanitizeHtml(html) {
+  return html;
+}
+
+sanitizeHtml.defaults = {
+  allowedTags: [],
+  allowedAttributes: {},
+};
+
+module.exports = sanitizeHtml;

packages/shared/package.json

@@ -49,7 +49,7 @@
     "@equal-vote/star-vote-backend": "^1.0.0",
     "@equal-vote/star-vote-frontend": "^0.1.0",
     "@types/sanitize-html": "^2.13.0",
-    "sanitize-html": "^2.13.1",
+    "sanitize-html": "^2.17.6",
     "socket.io": "^4.7.5",
     "socket.io-client": "^4.7.5",
     "typescript-json-schema": "^0.65.1"