diff --git a/client/components/codeEditor/codeEditor.jsx b/client/components/codeEditor/codeEditor.jsx
index c5cf669bd..25bf4f88e 100644
--- a/client/components/codeEditor/codeEditor.jsx
+++ b/client/components/codeEditor/codeEditor.jsx
@@ -308,7 +308,7 @@ const CodeEditor = forwardRef(
 			view.dispatch({
 				effects : themeCompartment.reconfigure(themeExtension),
 			});
-		}, [editorTheme]);
+		}, [editorTheme, tab]);
 
 		useEffect(()=>{
 			//rebuild syntax highlight when changing tab or renderer
diff --git a/client/homebrew/brewRenderer/safeHTML.js b/client/homebrew/brewRenderer/safeHTML.js
index d9438b663..ca2e59d5f 100644
--- a/client/homebrew/brewRenderer/safeHTML.js
+++ b/client/homebrew/brewRenderer/safeHTML.js
@@ -32,12 +32,12 @@ function safeHTML(htmlString) {
 			return;
 		}
 		// Check remaining elements for blacklisted attributes
-		for (const attribute of element.attributes){
+		[...element.attributes].forEach((attribute)=>{
 			if(blacklistAttrs.some((test)=>{return test(attribute);})) {
-				element.removeAttribute(attribute.localName);
-				break;
+				element.removeAttribute(attribute.name);
+				return;
 			};
-		};
+		});
 	});
 
 	return div.innerHTML;
diff --git a/package-lock.json b/package-lock.json
index 7687faa24..8a63bae96 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -25,7 +25,7 @@
         "@codemirror/language-data": "^6.5.2",
         "@codemirror/search": "^6.6.0",
         "@codemirror/state": "^6.6.0",
-        "@codemirror/view": "^6.43.1",
+        "@codemirror/view": "^6.43.7",
         "@dmsnell/diff-match-patch": "^1.1.0",
         "@googleapis/drive": "^20.2.0",
         "@lezer/highlight": "^1.2.3",
@@ -49,7 +49,7 @@
         "idb-keyval": "^6.2.5",
         "js-yaml": "^4.2.0",
         "jwt-simple": "^0.5.6",
-        "less": "^4.6.4",
+        "less": "^4.8.1",
         "lodash": "^4.18.1",
         "marked": "15.0.12",
         "marked-alignment-paragraphs": "^1.0.0",
@@ -63,7 +63,7 @@
         "marked-variables": "^1.0.5",
         "markedLegacy": "npm:marked@^0.3.19",
         "moment": "^2.30.1",
-        "mongoose": "^9.7.0",
+        "mongoose": "^9.9.0",
         "nanoid": "5.1.11",
         "nconf": "^0.13.0",
         "node": "^25.9.0",
@@ -2546,9 +2546,9 @@
       "license": "MIT"
     },
     "node_modules/@codemirror/view": {
-      "version": "6.43.6",
-      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.6.tgz",
-      "integrity": "sha512-EVunGSYN1wz1p75WY1s3Xg7t3i8Yol0kGZGizNdX9BUFgMFILYVe8/u6EVpo7Ff5PwbZuILb4QAq7IZoKzIEQA==",
+      "version": "6.43.7",
+      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.7.tgz",
+      "integrity": "sha512-FZsExxkoxnAN+d9TgqXLg5g4A1oQwzX9WlkOT5i2PKkcW7xx3Bmu0vs90g6fo9Mpdsb/l96dnAraQ8932aO4/g==",
       "license": "MIT",
       "dependencies": {
         "@codemirror/state": "^6.7.0",
@@ -9748,9 +9748,9 @@
       }
     },
     "node_modules/less": {
-      "version": "4.8.0",
-      "resolved": "https://registry.npmjs.org/less/-/less-4.8.0.tgz",
-      "integrity": "sha512-7Y7DJBMbsW29UGjOG6NGvxQEx71AaDcrryBwYCMaFwn0kj8FkSueKN9r9WexVOetKEhXh38kL++WJncfkEpS+g==",
+      "version": "4.8.1",
+      "resolved": "https://registry.npmjs.org/less/-/less-4.8.1.tgz",
+      "integrity": "sha512-jQ3lRIo1aUtiWVYXZ7mk4+V4BjCGswF3IxTLJ+4RUta8ZiHh8lhkig2G8dya2eCcyR1dYUvzuV46EkJN8PSwww==",
       "license": "Apache-2.0",
       "dependencies": {
         "copy-anything": "^3.0.5",
@@ -10540,9 +10540,9 @@
       }
     },
     "node_modules/mongoose": {
-      "version": "9.8.0",
-      "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-9.8.0.tgz",
-      "integrity": "sha512-PDGx3XACxrBQyWf4YT+5s1Xsx19x84UWGlRVIza4i9RG6qKjGcoG7odotT6uquR6YoaDMTZ6ZZc/jMXLrNPyyA==",
+      "version": "9.9.0",
+      "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-9.9.0.tgz",
+      "integrity": "sha512-xtBH8CU5oRK16F14rC8/KlRHeuPGP+w/URjDdwHV0oyN7otVuqglLje1FePX9+SaSBGj0/QiM65Tg86R7iNbPg==",
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
diff --git a/package.json b/package.json
index 35153c73b..f3e753c50 100644
--- a/package.json
+++ b/package.json
@@ -101,7 +101,7 @@
     "@codemirror/language-data": "^6.5.2",
     "@codemirror/search": "^6.6.0",
     "@codemirror/state": "^6.6.0",
-    "@codemirror/view": "^6.43.1",
+    "@codemirror/view": "^6.43.7",
     "@dmsnell/diff-match-patch": "^1.1.0",
     "@googleapis/drive": "^20.2.0",
     "@lezer/highlight": "^1.2.3",
@@ -125,7 +125,7 @@
     "idb-keyval": "^6.2.5",
     "js-yaml": "^4.2.0",
     "jwt-simple": "^0.5.6",
-    "less": "^4.6.4",
+    "less": "^4.8.1",
     "lodash": "^4.18.1",
     "marked": "15.0.12",
     "marked-alignment-paragraphs": "^1.0.0",
@@ -139,7 +139,7 @@
     "marked-variables": "^1.0.5",
     "markedLegacy": "npm:marked@^0.3.19",
     "moment": "^2.30.1",
-    "mongoose": "^9.7.0",
+    "mongoose": "^9.9.0",
     "nanoid": "5.1.11",
     "nconf": "^0.13.0",
     "node": "^25.9.0",
diff --git a/tests/html/safeHTML.test.js b/tests/html/safeHTML.test.js
index 0b5b4c169..71ab668ba 100644
--- a/tests/html/safeHTML.test.js
+++ b/tests/html/safeHTML.test.js
@@ -43,6 +43,12 @@ test('Javascript via inline event handler - onMouseOver', function() {
 	expect(rendered).toBe('<div>Hover over me</div>');
 });
 
+test('Javascript via multiple inline event handlers - onClick + onMouseOver', function() {
+	const source = `<div onclick="alert('This is a JavaScript injection via inline event handler')" onmouseover="alert('This is a JavaScript injection via inline event handler')">Hover over or Click me</div>`;
+	const rendered = safeHTML(source);
+	expect(rendered).toBe('<div>Hover over or Click me</div>');
+});
+
 test('Javascript via data attribute', function() {
 	const source = `<div data-code="javascript:alert('This is a JavaScript injection via data attribute')">Test</div>`;
 	const rendered = safeHTML(source);