Every web app that accepts user HTML has the same dependency buried somewhere in its node_modules: DOMPurify.
Temporal reached TC39 Stage 4 on March 11. It's in the ES2026 spec.