Skip to content

Bump dompurify from 3.4.1 to 3.4.12 - #822

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dompurify-3.4.12
Open

Bump dompurify from 3.4.1 to 3.4.12#822
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dompurify-3.4.12

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 24, 2026

Copy link
Copy Markdown
Contributor

Bumps dompurify from 3.4.1 to 3.4.12.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.11

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
  • Updated up the linting tool-chain and removed now-redundant lint directives
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.10

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
  • Decomposed the three largest sanitizer functions into focused helpers
  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
  • Reduced CI cost by running the full three-engine browser suite once per PR
  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
  • Documented the bench and test:happydom scripts in the README
  • Completed the Attack Classes & Bypass History wiki page
  • Bumped several dependencies where possible

DOMPurify 3.4.9

  • Further improved the handling of Trusted Types config options, thanks @​offset
  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
  • Added more test coverage for IN_PLACE and Trusted Types related usage
  • Bumped several dependencies where possible
  • Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

  • Cleaned up the repository root, renamed some and removed unneeded files
  • Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
  • Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
  • Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
  • Bumped several dependencies where possible

DOMPurify 3.4.7

  • Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
  • Removed a problem leading to permanent hook pollution, thanks @​offset
  • Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump dompurify from 3.4.1 to 3.4.12
3d30e3d 
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.1 to 3.4.12.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.1...3.4.12)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.12
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026
mtuchi added a commit that referenced this pull request Jul 27, 2026
@mtuchi @claude
Refresh remaining Dependabot-flagged dependencies
e45e7c7 
Covers all open Dependabot PRs (#811-#825) not already fixed:

- shell-quote 1.8.4 -> 1.10.0 (#825)
- fast-uri 3.1.2 -> 3.1.4 (#823)
- dompurify 3.4.1/3.4.2 -> 3.4.12 (#822)
- svgo 3.3.3 -> 3.3.4 (#821)
- websocket-driver 0.7.4 -> 0.7.5 (#818)
- js-yaml 3.14.2 -> 3.15.0 (#817)
- webpack-dev-server 5.2.4 -> 5.2.6 (#816)
- http-proxy-middleware 2.0.9 -> 2.0.10 (#815)
- @babel/core 7.25.2/7.27.4 -> 7.29.7 (#814)
- ws 7.5.10 -> 7.5.13, 8.18.3 -> 8.21.1 (#813)
- launch-editor 2.12.0 -> 2.14.1 (#811)

Also dedupes mermaid (theme-mermaid's >=11.6.0 was resolving to the
11.6.0 floor) to the already-pinned 11.15.0 via a resolution, clearing
the remaining 6 moderate advisories.

Audit is now clean except the documented brace-expansion 1.x advisory,
which has no compatible patch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
josephjclark pushed a commit that referenced this pull request Jul 27, 2026
@mtuchi @claude
Fix high-severity dependency vulnerabilities + adaptor changelog MDX …
658e2d3 
…escaping (#826)

* Fix high-severity dependency vulnerabilities

- axios 1.16.0 -> 1.18.0 (inherited-proxy issue in Node HTTP adapter)
- form-data 4.0.4/4.0.5 -> 4.0.6 (CRLF injection via multipart field names)
- sharp 0.34.2 -> 0.35.3 (inherited libvips CVEs: CVE-2026-33327/33328/35590/35591)
- brace-expansion 5.0.6 -> 5.0.8 (unbounded-expansion OOM DoS)
- brace-expansion 1.1.11 -> 1.1.16 (ReDoS, GHSA-v6h2-p8h4-qcjw)

Known remaining: brace-expansion 1.1.16 (via @docusaurus/core >
serve-handler > minimatch@3) is still flagged by the unbounded-expansion
advisory, which is only patched in 5.0.8. v5 is API-incompatible with
minimatch@3 and the whole chain is already at its latest versions, so no
safe fix exists; it only affects the local `docusaurus serve` command.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Refresh remaining Dependabot-flagged dependencies

Covers all open Dependabot PRs (#811-#825) not already fixed:

- shell-quote 1.8.4 -> 1.10.0 (#825)
- fast-uri 3.1.2 -> 3.1.4 (#823)
- dompurify 3.4.1/3.4.2 -> 3.4.12 (#822)
- svgo 3.3.3 -> 3.3.4 (#821)
- websocket-driver 0.7.4 -> 0.7.5 (#818)
- js-yaml 3.14.2 -> 3.15.0 (#817)
- webpack-dev-server 5.2.4 -> 5.2.6 (#816)
- http-proxy-middleware 2.0.9 -> 2.0.10 (#815)
- @babel/core 7.25.2/7.27.4 -> 7.29.7 (#814)
- ws 7.5.10 -> 7.5.13, 8.18.3 -> 8.21.1 (#813)
- launch-editor 2.12.0 -> 2.14.1 (#811)

Also dedupes mermaid (theme-mermaid's >=11.6.0 was resolving to the
11.6.0 floor) to the already-pinned 11.15.0 via a resolution, clearing
the remaining 6 moderate advisories.

Audit is now clean except the documented brace-expansion 1.x advisory,
which has no compatible patch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Escape MDX-breaking characters in generated adaptor changelogs and readmes

The gmail adaptor 3.0.0 changelog contains "in <3.0", which MDX parses
as a JSX tag start and fails the build (test-deploy CI). Extract the
code-block-aware escaping already used for jsdoc braces into an
escapeMdx() helper, add escaping of "<" when not followed by a
character that can start a JSX tag or HTML comment, and apply it to
changelog and readme generation too.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* remove comments

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

Documentation
Status: No status

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants