What's Changed
- Build dist on install so a branch or SHA can be depended on by @jeremy in #1228
- Move to dompurify 3.4.13, and validate attachment URLs ourselves by @jeremy in #1229
- Keep an image's alternative text and intrinsic size in attachment content by @jeremy in #1230
- Give Lexxy its own DOMPurify instance, and an allowlist per editor by @jeremy in #1231
- Claim a "lexxy" Trusted Types policy instead of racing the host for "dompurify" by @jeremy in #1232
- Apply mXSS-safe SAFE_FOR_XML on attachment content re-inflation by @jeremy in #1226
- Credit @PetitPois for the reported DOMPurify url bypass by @jeremy in #1244
- Bump the github-actions group across 1 directory with 8 updates by @dependabot[bot] in #1113
- Let an editor declare a URI-safe scheme, so custom-scheme values survive by @jeremy in #1245
Full Changelog: v0.9.30...v0.9.31
Contributors
jeremy, PetitPois, and dependabot