Skip to content

Bump the npm_and_yarn group in /website with 3 updates#1133

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/website/npm_and_yarn-77d78f9713
Closed

Bump the npm_and_yarn group in /website with 3 updates#1133
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/website/npm_and_yarn-77d78f9713

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 10, 2025

Bumps the npm_and_yarn group in /website with 3 updates: dompurify, katex and prismjs.

Updates dompurify from 3.2.3 to 3.2.4

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year
Commits
  • ec29e65 Merge pull request #1062 from cure53/main
  • 1c1b183 chore: Preparing 3.2.4 release
  • d18ffcb fix: Changed the template literal regex to avoid a config-dependent bypass
  • 0d64d2b Merge pull request #1060 from yehuya/initializeTestImprovements
  • 9ad7933 tests: DOMPurify custom window tests improvements
  • 72760ca Merge pull request #1059 from yehuya/fixMissingWindowElement
  • bc72d44 Fix tests
  • 363a89d fix: handle undefined Element in DOMPurify initialization
  • f41b45d Update LICENSE
  • b25bf26 Update README.md
  • Additional commits viewable in compare view

Updates katex from 0.16.19 to 0.16.21

Release notes

Sourced from katex's releases.

v0.16.21

0.16.21 (2025-01-17)

Bug Fixes

v0.16.20

0.16.20 (2025-01-12)

Bug Fixes

Changelog

Sourced from katex's changelog.

0.16.21 (2025-01-17)

Bug Fixes

  • escape \htmlData attribute name (57914ad)

0.16.20 (2025-01-12)

Bug Fixes

Commits
  • 923f2aa chore(release): 0.16.21 [ci skip]
  • 57914ad fix: escape \htmlData attribute name
  • ff28995 Merge commit from fork
  • 28a0bf5 chore(release): 0.16.20 [ci skip]
  • 6d30fe4 fix: \providecommand does not overwrite existing macro (#4000)
  • 8f47dba chore(deps): update actions/upload-artifact to v4 (#4012)
  • See full diff in compare view

Updates prismjs from 1.29.0 to 1.30.0

Release notes

Sourced from prismjs's releases.

v1.30.0

What's Changed

New Contributors

Full Changelog: PrismJS/prism@v1.29.0...v1.30.0

Changelog

Sourced from prismjs's changelog.

Prism Changelog

Commits
Maintainer changes

This version was pushed to npm by dmitrysharabin, a new releaser for prismjs since your current version.


You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the npm_and_yarn group in /website with 3 updates: [dompurify](https://github.com/cure53/DOMPurify), [katex](https://github.com/KaTeX/KaTeX) and [prismjs](https://github.com/PrismJS/prism).


Updates `dompurify` from 3.2.3 to 3.2.4
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.2.3...3.2.4)

Updates `katex` from 0.16.19 to 0.16.21
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.16.19...v0.16.21)

Updates `prismjs` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/PrismJS/prism/releases)
- [Changelog](https://github.com/PrismJS/prism/blob/master/CHANGELOG.md)
- [Commits](PrismJS/prism@v1.29.0...v1.30.0)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: katex
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: prismjs
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Mar 10, 2025

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot added minor New features that do not break anything no-release Do not create a new release (wait for additional code changes) labels Mar 10, 2025
@dependabot dependabot bot requested a review from a team as a code owner March 10, 2025 22:39
@mergify mergify bot added the auto-update This PR was automatically generated label Mar 10, 2025
@codecov
Copy link

codecov bot commented Mar 10, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 17.44%. Comparing base (f64a505) to head (0c6aef2).
⚠️ Report is 171 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1133   +/-   ##
=======================================
  Coverage   17.44%   17.44%           
=======================================
  Files         170      170           
  Lines       18764    18764           
=======================================
  Hits         3274     3274           
  Misses      14892    14892           
  Partials      598      598           
Flag Coverage Δ
unittests 17.44% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@settings settings bot removed the size/s label Jun 12, 2025
@github-actions
Copy link

Warning

This PR is blocked from merging because a required semver label is missing.

major, minor, patch, no-release

You'll need to add one before this PR can be merged.

@settings settings bot removed the size/s label Jun 13, 2025
@github-actions github-actions bot added the size/s Small size PR label Jun 13, 2025
@mergify
Copy link

mergify bot commented Oct 1, 2025

💥 This pull request now has conflicts. Could you fix it @dependabot[bot]? 🙏

@mergify mergify bot added the conflict This PR has conflicts label Oct 1, 2025
@mergify mergify bot closed this Oct 1, 2025
@mergify
Copy link

mergify bot commented Oct 1, 2025

This automated PR was closed due to merge conflicts.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 1, 2025

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/website/npm_and_yarn-77d78f9713 branch October 1, 2025 00:46
@mergify mergify bot removed the conflict This PR has conflicts label Oct 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-update This PR was automatically generated minor New features that do not break anything no-release Do not create a new release (wait for additional code changes) size/s Small size PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant