diff --git a/demo/package-lock.json b/demo/package-lock.json
index f6ce220c..7f6932e3 100644
--- a/demo/package-lock.json
+++ b/demo/package-lock.json
@@ -10,7 +10,7 @@
       "license": "Apache-2.0",
       "dependencies": {
         "budoux": "file:../javascript",
-        "dompurify": "^3.4.8"
+        "dompurify": "^3.4.9"
       },
       "devDependencies": {
         "concurrently": "^10.0.3",
@@ -24,7 +24,7 @@
       "version": "0.8.4",
       "license": "Apache-2.0",
       "dependencies": {
-        "commander": "^14.0.0",
+        "commander": "^15.0.0",
         "linkedom": "^0.18.7"
       },
       "bin": {
@@ -1054,9 +1054,9 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.4.8",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.8.tgz",
-      "integrity": "sha512-yb1cEmaOum7wFvOCSQxyfgVlv5D47Rc30iZWoMpbDIWTnJ6grDDQyu2KFJzB2k7u0pMuJcQ1zphH//fFnw2tjQ==",
+      "version": "3.4.9",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.9.tgz",
+      "integrity": "sha512-4dPSRMRDqHvs0V4YDFCsaIZo4if5u0xM+llyxiM2fwuZFdKArUBAF3VtI2+n8NKg9P870WMdYk0UhqQNoWXbfQ==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
@@ -2364,7 +2364,7 @@
         "@types/node": "^25.2.2",
         "@vitest/browser": "^4.0.18",
         "@vitest/browser-playwright": "^4.0.18",
-        "commander": "^14.0.0",
+        "commander": "^15.0.0",
         "esbuild": "^0.28.0",
         "linkedom": "^0.18.7",
         "playwright": "^1.58.0",
@@ -2590,9 +2590,9 @@
       "dev": true
     },
     "dompurify": {
-      "version": "3.4.8",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.8.tgz",
-      "integrity": "sha512-yb1cEmaOum7wFvOCSQxyfgVlv5D47Rc30iZWoMpbDIWTnJ6grDDQyu2KFJzB2k7u0pMuJcQ1zphH//fFnw2tjQ==",
+      "version": "3.4.9",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.9.tgz",
+      "integrity": "sha512-4dPSRMRDqHvs0V4YDFCsaIZo4if5u0xM+llyxiM2fwuZFdKArUBAF3VtI2+n8NKg9P870WMdYk0UhqQNoWXbfQ==",
       "requires": {
         "@types/trusted-types": "^2.0.7"
       }
diff --git a/demo/package.json b/demo/package.json
index 3185a924..ad9a8ee8 100644
--- a/demo/package.json
+++ b/demo/package.json
@@ -19,7 +19,7 @@
   "license": "Apache-2.0",
   "dependencies": {
     "budoux": "file:../javascript",
-    "dompurify": "^3.4.8"
+    "dompurify": "^3.4.9"
   },
   "devDependencies": {
     "concurrently": "^10.0.3",
diff --git a/javascript/package-lock.json b/javascript/package-lock.json
index a502c147..9d2b3821 100644
--- a/javascript/package-lock.json
+++ b/javascript/package-lock.json
@@ -1024,9 +1024,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "25.9.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.2.tgz",
-      "integrity": "sha512-G05zqtJhcDLb8uslf5EjCxXg9G1KQxiV8OS0R26IC//Eoyitzqe8z37I7cqvnZlrlSfgocQRfSn/AHBZJJFyGw==",
+      "version": "25.9.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.3.tgz",
+      "integrity": "sha512-603BddQMv3pUcr4U2dhujk83N2tTDVr/34wII2B6bJy6g+8WD6yUb11jszNs0gdi4PesVWl7ABt8nYMVpnLUcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {