diff --git a/web/package-lock.json b/web/package-lock.json
index e48045e39a..32af0eb876 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -44,7 +44,7 @@
                 "country-flag-icons": "^1.5.13",
                 "date-fns": "^4.1.0",
                 "deepmerge-ts": "^7.1.5",
-                "dompurify": "^3.2.4",
+                "dompurify": "^3.2.6",
                 "fuse.js": "^7.0.0",
                 "guacamole-common-js": "^1.5.0",
                 "hastscript": "^9.0.1",
@@ -11869,9 +11869,9 @@
             }
         },
         "node_modules/dompurify": {
-            "version": "3.2.4",
-            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.4.tgz",
-            "integrity": "sha512-ysFSFEDVduQpyhzAob/kkuJjf5zWkZD8/A9ywSp1byueyuCfHamrCBa14/Oc2iiB0e51B+NpxSl5gmzn+Ms/mg==",
+            "version": "3.2.6",
+            "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.6.tgz",
+            "integrity": "sha512-/2GogDQlohXPZe6D6NOgQvXLPSYBqIWMnZ8zzOhn09REE4eyAzb+Hed3jhoM9OkuaJ8P6ZGTTVWQKAi8ieIzfQ==",
             "license": "(MPL-2.0 OR Apache-2.0)",
             "optionalDependencies": {
                 "@types/trusted-types": "^2.0.7"
@@ -26897,14 +26897,14 @@
             },
             "devDependencies": {
                 "@goauthentik/core": "^1.0.0",
-                "@rollup/plugin-commonjs": "^28.0.3",
+                "@rollup/plugin-commonjs": "^28.0.0",
                 "@rollup/plugin-node-resolve": "^16.0.1",
                 "@rollup/plugin-swc": "^0.4.0",
                 "@swc/cli": "^0.4.0",
                 "@swc/core": "^1.7.28",
                 "@trivago/prettier-plugin-sort-imports": "^5.2.2",
                 "prettier": "^3.5.3",
-                "rollup": "^4.41.0",
+                "rollup": "^4.23.0",
                 "rollup-plugin-copy": "^3.5.0"
             },
             "optionalDependencies": {
diff --git a/web/package.json b/web/package.json
index a83b6942ae..0567d00693 100644
--- a/web/package.json
+++ b/web/package.json
@@ -114,7 +114,7 @@
         "country-flag-icons": "^1.5.13",
         "date-fns": "^4.1.0",
         "deepmerge-ts": "^7.1.5",
-        "dompurify": "^3.2.4",
+        "dompurify": "^3.2.6",
         "fuse.js": "^7.0.0",
         "guacamole-common-js": "^1.5.0",
         "hastscript": "^9.0.1",