diff --git a/CHANGELOG.md b/CHANGELOG.md
index fac0a21..204bb4e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,7 +16,7 @@ All notable changes are documented here. The format follows [Keep a Changelog](h
 
 ### Changed
 
-- Dependencies brought up to date: Clang 23 from LLVM's apt repository (was Debian's Clang 19), Node 26 LTS for the web build and CI (was 22), Gson 2.15, TanStack Query 5.105.1. The excluded test cases were regenerated with the new toolchain. TypeScript stays on 5.9 until openapi-typescript and typescript-eslint support 7.
+- Dependencies brought up to date: Clang 23 from LLVM's apt repository (was Debian's Clang 19), Node 26 LTS for the web build and CI (was 22), Gson 2.15, TanStack Query 5.105.1. The excluded test cases were regenerated with the new toolchain. TypeScript 6.0 (7 waits on typescript-eslint support).
 
 ### Fixed
 
@@ -24,6 +24,8 @@ All notable changes are documented here. The format follows [Keep a Changelog](h
 
 ### Security
 
+- Monaco's bundled DOMPurify is pinned to our patched 3.4.17 (Monaco 0.57 pins 3.4.15, affected by several XSS advisories); `npm audit --omit=dev` reports no vulnerabilities.
+
 - The runner has no network; the app reaches it over a group-restricted Unix socket.
 - Both containers run without root privileges or unneeded capabilities, under `no-new-privileges`.
 - Host-header and Origin checks, a content security policy and other security headers.
diff --git a/web/package-lock.json b/web/package-lock.json
index bc7878b..07c8c08 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -33,7 +33,7 @@
         "openapi-typescript": "^7.13.0",
         "playwright": "^1.64.1",
         "prettier": "^3.9.10",
-        "typescript": "5.9.3",
+        "typescript": "6.0.3",
         "typescript-eslint": "^8.72.1",
         "vite": "8.3.5",
         "vitest": "^5.0.5"
@@ -2631,15 +2631,6 @@
         "marked": "14.0.0"
       }
     },
-    "node_modules/monaco-editor/node_modules/dompurify": {
-      "version": "3.4.15",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz",
-      "integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
-      "optionalDependencies": {
-        "@types/trusted-types": "^2.0.7"
-      }
-    },
     "node_modules/monaco-editor/node_modules/marked": {
       "version": "14.0.0",
       "resolved": "https://registry.npmjs.org/marked/-/marked-14.0.0.tgz",
@@ -3223,9 +3214,9 @@
       }
     },
     "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
diff --git a/web/package.json b/web/package.json
index af9e7ff..2532eb7 100644
--- a/web/package.json
+++ b/web/package.json
@@ -41,9 +41,17 @@
     "openapi-typescript": "^7.13.0",
     "playwright": "^1.64.1",
     "prettier": "^3.9.10",
-    "typescript": "5.9.3",
+    "typescript": "6.0.3",
     "typescript-eslint": "^8.72.1",
     "vite": "8.3.5",
     "vitest": "^5.0.5"
+  },
+  "overrides": {
+    "openapi-typescript": {
+      "typescript": "$typescript"
+    },
+    "monaco-editor": {
+      "dompurify": "$dompurify"
+    }
   }
 }