Update build-and-test.yml#1282
Merged
Merged
Conversation
x00mario
approved these changes
Apr 17, 2026
cure53
added a commit
that referenced
this pull request
Apr 30, 2026
* build(deps): bump @tootallnate/once and jsdom (#1214) Removes [@tootallnate/once](https://github.com/TooTallNate/once). It's no longer used after updating ancestor dependency [jsdom](https://github.com/jsdom/jsdom). These dependencies need to be updated together. Removes `@tootallnate/once` Updates `jsdom` from 20.0.3 to 28.1.0 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Changelog](https://github.com/jsdom/jsdom/blob/main/Changelog.md) - [Commits](jsdom/jsdom@20.0.3...28.1.0) --- updated-dependencies: - dependency-name: "@tootallnate/once" dependency-version: dependency-type: indirect - dependency-name: jsdom dependency-version: 28.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump serialize-javascript and @rollup/plugin-terser (#1213) Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.0.4 and updates ancestor dependency [@rollup/plugin-terser](https://github.com/rollup/plugins/tree/HEAD/packages/terser). These dependencies need to be updated together. Updates `serialize-javascript` from 6.0.2 to 7.0.4 - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v6.0.2...v7.0.4) Updates `@rollup/plugin-terser` from 0.4.4 to 1.0.0 - [Changelog](https://github.com/rollup/plugins/blob/master/packages/terser/CHANGELOG.md) - [Commits](https://github.com/rollup/plugins/commits/beep-v1.0.0/packages/terser) --- updated-dependencies: - dependency-name: serialize-javascript dependency-version: 7.0.4 dependency-type: indirect - dependency-name: "@rollup/plugin-terser" dependency-version: 1.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: Fixed a problem with the type defition patcher after Node version bump * build(deps-dev): bump undici from 7.23.0 to 7.24.1 (#1216) Bumps [undici](https://github.com/nodejs/undici) from 7.23.0 to 7.24.1. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.23.0...v7.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 7.24.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump flatted from 3.4.1 to 3.4.2 (#1218) Bumps [flatted](https://github.com/WebReflection/flatted) from 3.4.1 to 3.4.2. - [Commits](WebReflection/flatted@v3.4.1...v3.4.2) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * test: Added more browser launchers to stay up-to-date * test: Testing whether the Browser Stack "latest" labels work * test: Expanded range of tested Node versions into both directions * fix: Removed Node 26 test target again, not available yet * fix: Removed Node 16 test target as it breaks * Update README.md (#1222) * build(deps-dev): bump serialize-javascript from 7.0.4 to 7.0.5 (#1223) Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) from 7.0.4 to 7.0.5. - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v7.0.4...v7.0.5) --- updated-dependencies: - dependency-name: serialize-javascript dependency-version: 7.0.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump lodash from 4.17.23 to 4.18.1 (#1228) Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 (#1225) Bumps [lodash-es](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash-es dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Create scorecard.yml * fix: FORBID_TAGS must win over ADD_TAGS function predicate (#1230) Mirrors the FORBID_ATTR early-exit pattern (c361baa, line 1214) for FORBID_TAGS. When EXTRA_ELEMENT_HANDLING.tagCheck is a function that returns true, the short-circuit evaluation previously skipped the FORBID_TAGS check, allowing forbidden elements through. Moves FORBID_TAGS[tagName] to an OR at the top of the condition so the removal block is always entered for forbidden tags regardless of the tagCheck predicate result. * Update build-and-test.yml * [StepSecurity] Apply security best practices (#1231) Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> * build(deps-dev): bump jsdom from 28.1.0 to 29.0.2 (#1240) Bumps [jsdom](https://github.com/jsdom/jsdom) from 28.1.0 to 29.0.2. - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v28.1.0...v29.0.2) --- updated-dependencies: - dependency-name: jsdom dependency-version: 29.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump rollup-plugin-dts from 6.4.0 to 6.4.1 (#1239) Bumps [rollup-plugin-dts](https://github.com/Swatinem/rollup-plugin-dts) from 6.4.0 to 6.4.1. - [Changelog](https://github.com/Swatinem/rollup-plugin-dts/blob/master/CHANGELOG.md) - [Commits](Swatinem/rollup-plugin-dts@v6.4.0...v6.4.1) --- updated-dependencies: - dependency-name: rollup-plugin-dts dependency-version: 6.4.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump cross-env from 7.0.3 to 10.1.0 (#1238) Bumps [cross-env](https://github.com/kentcdodds/cross-env) from 7.0.3 to 10.1.0. - [Release notes](https://github.com/kentcdodds/cross-env/releases) - [Changelog](https://github.com/kentcdodds/cross-env/blob/main/CHANGELOG.md) - [Commits](kentcdodds/cross-env@v7.0.3...v10.1.0) --- updated-dependencies: - dependency-name: cross-env dependency-version: 10.1.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump actions/upload-artifact from 4.6.1 to 7.0.1 (#1237) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.1 to 7.0.1. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@4cec3d8...043fb46) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump @rollup/plugin-node-resolve from 15.3.1 to 16.0.3 (#1236) Bumps [@rollup/plugin-node-resolve](https://github.com/rollup/plugins/tree/HEAD/packages/node-resolve) from 15.3.1 to 16.0.3. - [Changelog](https://github.com/rollup/plugins/blob/master/packages/node-resolve/CHANGELOG.md) - [Commits](https://github.com/rollup/plugins/commits/node-resolve-v16.0.3/packages/node-resolve) --- updated-dependencies: - dependency-name: "@rollup/plugin-node-resolve" dependency-version: 16.0.3 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 (#1235) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.1 to 2.4.3. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...4eaacf0) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump actions/checkout from 4.2.2 to 6.0.2 (#1234) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.2.2...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump @babel/preset-env from 7.29.0 to 7.29.2 (#1233) Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.29.0 to 7.29.2. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-preset-env) --- updated-dependencies: - dependency-name: "@babel/preset-env" dependency-version: 7.29.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump github/codeql-action from 3.35.1 to 4.35.1 (#1232) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3.35.1...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Added CONTRIBUTIONS.md * chore: Regenerated dist versions * fix: added osv-scanner.toml to ignore flagged deps * chore: update build-and-test.yml to get rid of a warning * docs: update README.md with OSF results * docs: update build-and-test.yml name * docs: update README.md badges * test: removed nine really old browsers from karma tests * fix: apply SAFE_FOR_TEMPLATES scrub in RETURN_DOM path (#1241) The RETURN_DOM path returns before the final template expression scrub, allowing split mustache expressions to reconstruct after element removal. Normalize adjacent text nodes and scrub body before building the return node. Co-authored-by: Developer <dev@devcontainer.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: prevent ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls (#1242) When sanitize() is called with ADD_ATTR or ADD_TAGS as a function, the function reference is stored in EXTRA_ELEMENT_HANDLING. A subsequent call that passes ADD_ATTR/ADD_TAGS as an array did not clear the stored function because objectHasOwnProperty(cfg, 'ADD_ATTR') returned true, skipping the conditional reset. The leaked function is evaluated before URI/tag checks, so a permissive function (returning true) lets dangerous attributes (e.g. javascript: URIs) or forbidden tags (e.g. iframe) through on later calls. Fix: unconditionally reset tagCheck/attributeCheck to null on every _parseConfig() call, then only set them if the current config provides a function. This ensures no cross-call leakage. Includes regression tests for both ADD_ATTR and ADD_TAGS leakage scenarios. * test: reduced number of tested browsers again to be at 24 * Fix mathML attributes (#1243) * test: reducing BS browser array once more to get unstuck * test: temporarily reduced browser test array to four main items :-( * build(deps-dev): bump eslint-config-prettier from 8.10.2 to 10.1.8 (#1244) Bumps [eslint-config-prettier](https://github.com/prettier/eslint-config-prettier) from 8.10.2 to 10.1.8. - [Release notes](https://github.com/prettier/eslint-config-prettier/releases) - [Changelog](https://github.com/prettier/eslint-config-prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/eslint-config-prettier/commits/v10.1.8) --- updated-dependencies: - dependency-name: eslint-config-prettier dependency-version: 10.1.8 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump rollup from 3.30.0 to 4.60.1 (#1246) Bumps [rollup](https://github.com/rollup/rollup) from 3.30.0 to 4.60.1. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v3.30.0...v4.60.1) --- updated-dependencies: - dependency-name: rollup dependency-version: 4.60.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#1249) Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.11 to 1.16.0. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) --- updated-dependencies: - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * test: carefully expanded array of tested BS browsers again * test: experimenting with new BS config to avoid the freezes test: removed two Safari versions as they might be the cause docs: updated version numbers for upcoming release * test: reverted to old BS config values as they worked better * Update LICENSE (#1254) * test: added three more browsers to test array (OSX, mobile) * Update karma.custom-launchers.config.js (#1256) * docs: updated list of contributors and fixed some outdated docs (#1257) * Update README.md (#1258) * test: added first scaffold for a simple data type and config fuzzer * test: added first scaffold for a simple data type and config fuzzer (#1259) * build(deps-dev): bump @rollup/plugin-babel from 6.1.0 to 7.0.0 (#1264) Bumps [@rollup/plugin-babel](https://github.com/rollup/plugins/tree/HEAD/packages/babel) from 6.1.0 to 7.0.0. - [Changelog](https://github.com/rollup/plugins/blob/master/packages/babel/CHANGELOG.md) - [Commits](https://github.com/rollup/plugins/commits/url-v7.0.0/packages/babel) --- updated-dependencies: - dependency-name: "@rollup/plugin-babel" dependency-version: 7.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump @types/node from 16.18.126 to 25.6.0 (#1262) Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 16.18.126 to 25.6.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.6.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Cure53 <mario@cure53.de> * build(deps-dev): bump rollup-plugin-typescript2 from 0.36.0 to 0.37.0 (#1263) Bumps [rollup-plugin-typescript2](https://github.com/ezolenko/rollup-plugin-typescript2) from 0.36.0 to 0.37.0. - [Release notes](https://github.com/ezolenko/rollup-plugin-typescript2/releases) - [Changelog](https://github.com/ezolenko/rollup-plugin-typescript2/blob/master/CHANGELOG.md) - [Commits](ezolenko/rollup-plugin-typescript2@0.36.0...0.37.0) --- updated-dependencies: - dependency-name: rollup-plugin-typescript2 dependency-version: 0.37.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Cure53 <mario@cure53.de> * test: Extended the fuzzer a bit to cover the config object * Cure53 basic fuzzer (#1265) * test: added first scaffold for a simple data type and config fuzzer * test: Extended the fuzzer a bit to cover the config object * test: expanded fuzzer test coverage for bad config values fix: fixed several crashes caused by bad config values and data types fix: added necessary utility messages to utils.js * Cure53 basic fuzzer (#1266) * test: added first scaffold for a simple data type and config fuzzer * test: Extended the fuzzer a bit to cover the config object * test: expanded fuzzer test coverage for bad config values fix: fixed several crashes caused by bad config values and data types fix: added necessary utility messages to utils.js * fix: made the NAMESAPCE config handling less crashy * fix: added better config hardening and removed crash potentials test: expanded test suite to cover above changes * Update README.md Added new badge, added `npm run test:fuzz` info * chore(deps): bump rimraf, prettier, eslint-plugin-prettier, minimist * style: reformat codebase with Prettier 3 * chore(test): migrate from Karma to Playwright for browser tests Karma has been deprecated since April 2023 and has been blocking Dependabot updates across the dev-dependency tree. This migration replaces it with Playwright while preserving all existing test logic. Changes: - Replace Karma + karma-* plugin ecosystem with @playwright/test - Add tiny zero-dep static file server for the Playwright webServer - Add HTML runner pages for dist/purify.js and dist/purify.min.js that load QUnit, jQuery, DOMPurify, test-suite.js, and an ES module entry - Add Playwright spec that drives each runner, waits for QUnit.done, and surfaces per-assertion failure detail on error - Drop rollup-plugin-includepaths (was only aliasing 'purify' for Karma) - Drop minimist (was only used by the old custom-launchers config) - Update build-and-test.yml to install Playwright browsers and upload playwright-report/ artifact on failure Unchanged: - test/test-suite.js (2398 lines of QUnit assertions) - test/bootstrap-test-suite.js - test/fixtures/expect.mjs - test/config/setup.js - test/jsdom-node-runner.js, test/jsdom-node.js - test/fuzz/** - rollup.config.js, src/**, scripts/** Browser coverage: chromium, firefox, and webkit run locally and on non-BrowserStack CI (3 rendering engines: Blink, Gecko, WebKit). The 28-browser BrowserStack matrix is temporarily disabled and will be restored in a follow-up PR via browserstack-node-sdk. Test counts verified identical pre/post migration: 911 QUnit tests × 2 suites, all passing. * fix(test): harden test/browser/server.js against path traversal and reflected XSS * ci(test): add cross-OS browser matrix (ubuntu + macOS + windows) * fix: added pinning hash for dependency * Update README.md Updated browser test coverage info * build: migrate rollup-plugin-typescript2 and pre-commit Switch rollup-plugin-typescript2 → @rollup/plugin-typescript (official, actively maintained by the Rollup team). Type declaration pipeline is unaffected — types are generated by tsc directly, not the rollup plugin. Switch pre-commit → husky (modern standard, zero runtime deps, actively maintained). Hook behavior is identical: lint + build + stage dist files. The prepare script ensures hooks install automatically on npm install. * chore: cleaned up two ignored issues from OSV TOML file * chore: removed some unneeded files build: made sure npx is properly pinned and not flagged by scorecard * chore: removed some unneeded files (#1279) build: made sure npx is properly pinned and not flagged by scorecard Co-authored-by: Mario Heiderich <mario.heiderich@gmail.com> * Create CODEOWNERS (#1280) * Update build-and-test.yml (#1282) * build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#1288) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 (#1286) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4.6.2...043fb46) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Cure53 <mario@cure53.de> * build(deps): bump step-security/harden-runner from 2.17.0 to 2.18.0 (#1285) Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.17.0 to 2.18.0. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@f808768...6c3c2f2) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.18.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Cure53 <mario@cure53.de> * build(deps-dev): bump fast-check from 4.6.0 to 4.7.0 (#1287) Bumps [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) from 4.6.0 to 4.7.0. - [Release notes](https://github.com/dubzzz/fast-check/releases) - [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md) - [Commits](https://github.com/dubzzz/fast-check/commits/v4.7.0/packages/fast-check) --- updated-dependencies: - dependency-name: fast-check dependency-version: 4.7.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Cure53 <mario@cure53.de> * Update purify.ts (#1290) chore: removed some risky dead code, thanks @1Jesper1 * Update config.ts (#1291) chore: fixed a typo, thanks @1Jesper1 * Update README.md (#1292) * build(deps-dev): bump rollup from 4.60.1 to 4.60.2 (#1294) Bumps [rollup](https://github.com/rollup/rollup) from 4.60.1 to 4.60.2. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.60.1...v4.60.2) --- updated-dependencies: - dependency-name: rollup dependency-version: 4.60.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update attrs.ts (#1295) fix: removed a duplicate entry * Cure53 code hardening (#1296) * chore: added stronger check for HTML Custom Element tagnames cxhore: added stronger check for IN_PLACE tagname types * test: add regression and pinning tests from April 2026 review * test: added more fuzzer properties and a negative check (#1297) * Cure53 fuzzer update (#1298) * test: added more fuzzer properties and a negative check * chore: getting ready for 3.4.1 release * Create sign-release.yml (#1303) * Create sign-release.yml * Create slsa-provenance.yml * Update scorecard.yml (#1304) * Update scorecard.yml * Update sign-release.yml * Update slsa-provenance.yml * Update sign-release.yml * Update slsa-provenance.yml (#1305) * Update slsa-provenance.yml * Update sign-release.yml * Update slsa-provenance.yml * Update scorecard.yml (#1306) * Update scorecard.yml (#1307) * chore: added new workflow files for a first test (#1308) * chore: added new workflow files for a first test * chore: adjusted the build-and-test workflow slightly * chore: added a build-and-test-skip workflow to save on time and CPU * Cure53 expanding tests (#1310) * test: expanded test coverage for form clobbering and type confusions * test: removed some outdated comments in test suite * Update build-and-test.yml (#1311) * build(deps): bump actions/attest-build-provenance from 2.2.3 to 4.1.0 (#1315) Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2.2.3 to 4.1.0. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@c074443...a2bbfa2) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#1314) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.3.0 to 6.4.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@53b8394...48b55a0) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump sigstore/gh-action-sigstore-python from 3.2.0 to 3.3.0 (#1312) Bumps [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python) from 3.2.0 to 3.3.0. - [Release notes](https://github.com/sigstore/gh-action-sigstore-python/releases) - [Changelog](https://github.com/sigstore/gh-action-sigstore-python/blob/main/CHANGELOG.md) - [Commits](sigstore/gh-action-sigstore-python@a5caf34...04cffa1) --- updated-dependencies: - dependency-name: sigstore/gh-action-sigstore-python dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump step-security/harden-runner from 2.18.0 to 2.19.0 (#1313) Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.18.0 to 2.19.0. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@6c3c2f2...8d3c67d) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update package.json (#1317) fix #1316 * build(deps-dev): bump jsdom from 29.0.2 to 29.1.0 (#1318) Bumps [jsdom](https://github.com/jsdom/jsdom) from 29.0.2 to 29.1.0. - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v29.0.2...v29.1.0) --- updated-dependencies: - dependency-name: jsdom dependency-version: 29.1.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: apply URI validation to attributes allowed via ADD_ATTR callback (#1320) * fix: apply URI validation to attributes allowed via ADD_ATTR callback The function form of ADD_ATTR (introduced in PR #1150) allowed attribute names to bypass URI scheme validation. When the attributeCheck callback returned true, the attribute value was accepted without checking it against IS_ALLOWED_URI, meaning javascript: and data: URIs could pass through unsanitized. The array form of ADD_ATTR and the default ALLOWED_ATTR set both flow through URI validation correctly; the function form now does too. The fix removes the attributeCheck branch as a separate early-exit and folds it into the name-permitted test that precedes value validation: const nameIsPermitted = ALLOWED_ATTR[lcName] || (EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag)); } else if (!nameIsPermitted || FORBID_ATTR[lcName]) { Tests added: javascript: URI is stripped when href is allowed via ADD_ATTR callback; safe https: URI is preserved. * test: use assert.equal to avoid CodeQL substring URL warning * release: 3.4.2 (#1321) --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kodareef5 <kodareef5@gmail.com> Co-authored-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: bencalif <ben@calif.io> Co-authored-by: Developer <dev@devcontainer.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: 1Jesper1 <1jesper1@gmail.com> Co-authored-by: David Oliver <github_0UEMJhIUyGLn7@doliver.co.uk> Co-authored-by: Mario Heiderich <mario.heiderich@gmail.com> Co-authored-by: Drew Neil <andrew.jr.neil@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changed npm install to npm ci (testing)