Skip to content

chore(deps): update dependency dompurify to v3.4.1#977

Merged
gabrielseco merged 1 commit intomainfrom
renovate/dompurify-3.x
Apr 29, 2026
Merged

chore(deps): update dependency dompurify to v3.4.1#977
gabrielseco merged 1 commit intomainfrom
renovate/dompurify-3.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 28, 2026

This PR contains the following updates:

Package Change Age Confidence
dompurify 3.4.03.4.1 age confidence

Release Notes

cure53/DOMPurify (dompurify)

v3.4.1: DOMPurify 3.4.1

Compare Source

  • Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
  • Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
  • Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
  • Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
  • Removed a duplicate slot entry from the default HTML attribute allow-list
  • Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
  • Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
  • Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link
Copy Markdown
Contributor

📦 Bundle Size Report

Metric Current Previous Change Status
Total (gzip) 211.28 kB 211.26 kB +13 B (+0.0%) 🔴
Total (raw) 570.24 kB 570.24 kB 0 B (0%) 🟢
CSS (gzip) 20.66 kB 20.66 kB 0 B (0%) 🟢
CSS (raw) 107.8 kB 107.8 kB 0 B (0%) 🟢

Size Limits

  • ✅ Total gzipped: 211.28 kB / 250 kB (84.5%)
  • ✅ Total raw: 570.24 kB / 600 kB (95.0%)
  • ✅ CSS gzipped: 20.66 kB / 25 kB (82.6%)

Largest Files (Top 5)

  1. chunk-3OJQ3OSP.js - 13.9 kB (0 B (0%))
  2. styles.css - 10.33 kB (0 B (0%))
  3. index.css - 10.33 kB (0 B (0%))
  4. index.js - 6.07 kB (+5 B (+0.1%))
  5. chunk-TNQKP2XT.js - 5.89 kB (0 B (0%))
View All Files (313 total)
File Size (gzip) Change
chunk-3OJQ3OSP.js 13.9 kB 0 B (0%)
styles.css 10.33 kB 0 B (0%)
index.css 10.33 kB 0 B (0%)
index.js 6.07 kB +5 B (+0.1%)
chunk-TNQKP2XT.js 5.89 kB 0 B (0%)
chunk-5HFWFX7T.js 5.81 kB 0 B (0%)
chunk-H7K32A2D.js 4.51 kB 0 B (0%)
chunk-Y7L6VZOT.js 4.29 kB new
chunk-DPVXTQAB.js 4.06 kB 0 B (0%)
chunk-N2PSMOMR.js 3.73 kB 0 B (0%)

✅ Bundle size check passed

@github-actions
Copy link
Copy Markdown
Contributor

📊 Coverage Report

⚪ Coverage unchanged

Metric Current Previous Change Status
Lines 89.95% 89.95% 0%
Statements 89.62% 89.62% 0%
Functions 87.69% 87.69% 0%
Branches 80.04% 80.04% 0%

Detailed Breakdown

Lines Coverage
  • Covered: 3650 / 4058
  • Coverage: 89.95%
  • Change: 0% (0 lines)
Statements Coverage
  • Covered: 3711 / 4141
  • Coverage: 89.62%
  • Change: 0% (0 statements)
Functions Coverage
  • Covered: 997 / 1137
  • Coverage: 87.69%
  • Change: 0% (0 functions)
Branches Coverage
  • Covered: 2262 / 2826
  • Coverage: 80.04%
  • Change: 0% (0 branches)

✅ Coverage check passed

@github-actions
Copy link
Copy Markdown
Contributor

Deploy preview for remote-flows ready!

Project:remote-flows
Status: ✅  Deploy successful!
Preview URL:https://remote-flows-3958d8zpu-remotecom.vercel.app
Latest Commit:b8e4d13
Inspect:View deployment

Deployed with vercel-action

@gabrielseco gabrielseco merged commit 922a677 into main Apr 29, 2026
11 checks passed
@gabrielseco gabrielseco deleted the renovate/dompurify-3.x branch April 29, 2026 07:04
@gabrielseco gabrielseco mentioned this pull request May 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant