fix: harden sanitize-html xmp handling (GHSA-rpr9-rxv7-x643)#24

Merged

SINENSIA merged 3 commits into

mainfrom

fix/ghsa-rpr9-rxv7-x643

May 14, 2026

Commits on May 14, 2026

fix: hardened sanitize-html configuration path against GHSA-rpr9-rxv7-x643 by forcing disallowed xmp content into nonTextTags unless xmp is explicitly allowed. That change is in lib/allowlist.js. I…
scops
committed
Merge branch 'main' into fix/ghsa-rpr9-rxv7-x643
scops
authored
fix: bump sanitize-html to 2.17.4 for GHSA-rpr9-rxv7-x643
scops
committed