chore(deps): bump dompurify from 3.3.2 to 3.4.0 in /libs/a2a-core

[dependabot]

Bumps dompurify from 3.3.2 to 3.4.0.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

• Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
• Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
• Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
• Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
• Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
• Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
• Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth
• Fixed an issue with USE_PROFILES prototype pollution, thanks @​christos-eth
• Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @​researchatfluidattacks and others
• Fixed an issue with closing tags leading to possible mXSS, thanks @​frevadiscor
• Fixed a problem with the type dentition patcher after Node version bump
• Fixed freezing BS runs by reducing the tested browsers array
• Bumped several dependencies where possible
• Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

DOMPurify 3.3.3

• Fixed an engine requirement for Node 20 which caused hiccups, thanks @​Rotzbua

Commits

• 5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
• 8bcbf73 chore: Preparing 3.3.3 release
• 5faddd6 fix: engine requirement (#1210)
• 0f91e3a Update README.md
• d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
• c3efd48 fix: moved back from jsdom 28 to jsdom 20
• 988b888 fix: moved back from jsdom 28 to jsdom 20
• 2726c74 chore: Preparing 3.3.2 release
• 6202c7e build(deps): bump @​tootallnate/once and jsdom (#1204)
• 302b51d fix: Expanded the regex ever so slightly to also cover script
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

📊 Coverage check completed. See workflow run for details.

[github-actions]

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

• Current: chore(deps): bump dompurify from 3.3.2 to 3.4.0 in /libs/a2a-core
• Issue: None — title is clear, follows conventional commit style, and indicates scope and dependency bump.
• Recommendation: Keep as-is.

---

❌ Commit Type

• The PR body does not include the required PR template checkboxes. The title indicates this is a chore (dependency bump), but the template section "Commit Type" was not filled out in the PR description.
• Recommendation: Update the PR body template and check only one commit type. For this PR, select - [x] chore - Maintenance/tooling in the Commit Type section and add a short note if multiple items are truly relevant.

---

❌ Risk Level

• The PR is missing a risk label and the PR body did not select a Risk Level. Every PR should include exactly one risk level selection (Low/Medium/High) and a matching repo label (e.g. risk:low, risk:medium, risk:high).
• Assessment: Based on the code diff (a direct bump of dompurify from 3.3.2 -> 3.4.0), I recommend risk:medium.
  • Rationale: DOMPurify is a security-sensitive library (HTML sanitizer). Although this is a minor version bump with security and bug fixes (mXSS, prototype-pollution fixes) — which is good — changes in sanitization behavior can affect app behavior or security expectations. Marking Medium encourages reviewers to validate integration points and run proper tests.
• Recommendation: Add the label risk:medium to the PR and in the PR body select - [x] Medium - Moderate changes, some user impact.

---

❌ What & Why

• Current: (Missing) — the PR body is auto-generated Dependabot text and does not include the PR template "What & Why" section filled out.
• Issue: The template requires a brief "What does this change and why?" explanation. Even for dependency bumps, include a short summary of impact and reason.
• Recommendation: Add a short blurb such as:
  • "What: Bump dompurify from 3.3.2 to 3.4.0 in libs/a2a-core (sanitizer library).\n - Why: Contains bug and security fixes (mXSS and prototype-pollution fixes) from upstream; ensures our sanitizer is up-to-date."

---

❌ Impact of Change

• The PR body lacks the Impact of Change section from the template.
• Recommendation: Fill this section to clarify who/what is affected. Example content to paste/update:
  • Users: No direct UI changes expected; possible change in how certain HTML inputs are sanitized which may fix XSS issues for users.
  • Developers: Update may change sanitizer behavior; review code paths where DOMPurify is configured/used and verify there are no behavioral regressions.
  • System: Minimal perf impact expected; run CI and existing test suites to validate.

---

❌ Test Plan

• Assessment: Missing. The repo diff only changes package.json (1 addition, 1 deletion). No unit tests or E2E tests were added/updated and there is no explanation for testing.
• Per repository rules: If no unit tests and no E2E tests are added and there's no explanation as to why, the PR should fail this check.
• Recommendation (pick at least one):
  • Add/verify unit tests or integration tests that cover areas using DOMPurify (sanitization, whitelists/blacklists, return DOM path, custom element handling). OR
  • If tests already exist and cover compatibility, explicitly state in the Test Plan: run full CI, list which tests were observed to pass, and include any manual test steps (e.g., smoke test editor flows that accept user HTML, validate sanitized output). OR
  • If this is a safe patch update with no codepaths changed and you have validated the app via CI and manual smoke tests, state that clearly and mention the CI run / checks used.
• Also ensure the PR includes the updated lockfile (yarn.lock / package-lock.json / pnpm-lock.yaml) so CI uses the bumped version. Currently only package.json changed — please include the updated lockfile if your package manager produces one.

---

⚠️ Contributors

• Assessment: Empty in PR body. This is optional and may remain blank, but it's nice to credit reviewers/PMs/designers where appropriate.
• Recommendation: Optionally add contributors or a short credit line if others assisted.

---

⚠️ Screenshots/Videos

• Assessment: Not applicable — not a visual change.
• Recommendation: No screenshots needed. Mark as N/A in the template.

---

Summary Table

Section	Status	Recommendation
Title	✅	Keep as-is (chore(deps): bump dompurify ...)
Commit Type	❌	Update template: select chore and include a short comment
Risk Level	❌	Add risk:medium label and select Medium in template
What & Why	❌	Add a brief "What & Why" explaining the dependency bump
Impact of Change	❌	Fill out Users/Developers/System impacts as recommended
Test Plan	❌	Add unit/integration tests or a detailed testing justification and include updated lockfile
Contributors	⚠️	Optional: add credits if applicable
Screenshots/Videos	⚠️	N/A (no visual change)

---

Final notes & next steps

• Please update the PR body to use the required template sections. For this dependency bump specifically, ensure you:
  1. Add the PR template fields and mark Commit Type = chore.
  2. Select Risk Level = Medium and add label risk:medium to this PR.
  3. Add a concise What & Why explaining this is a dompurify security/bugfix bump.
  4. Update Impact of Change and Test Plan. If there are existing tests covering DOMPurify usage, list them and confirm they passed; otherwise add a short integration test or manual test plan and include CI results.
  5. Include the updated lockfile (yarn.lock / package-lock.json / pnpm-lock.yaml) so the dependency change is reproducible in CI.
  6. Run full CI and note results in the Test Plan section.

Because the PR currently lacks a filled PR template, a risk label, and any test plan or lockfile update, I cannot pass this PR at this time. Please make the requested updates and re-request review. Thank you!

---

Last updated: Thu, 16 Apr 2026 04:35:54 GMT