Skip to content

chore(deps): bump dompurify from 3.2.6 to 3.3.2#3595

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/dompurify-3.3.2
Closed

chore(deps): bump dompurify from 3.2.6 to 3.3.2#3595
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/dompurify-3.3.2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 5, 2026

Bumps dompurify from 3.2.6 to 3.3.2.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.2

  • Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
  • Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
  • Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
  • Bumped and removed several dependencies, thanks @​Rotzbua
  • Fixed the test suite after bumping dependencies, thanks @​Rotzbua

DOMPurify 3.3.1

  • Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @​MariusRumpf
  • Updated the ESM import syntax to be more correct, thanks @​binhpv

DOMPurify 3.3.0

  • Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
  • Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
  • Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren

DOMPurify 3.2.7

  • Added new attributes and elements to default allow-list, thanks @​elrion018
  • Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
  • Added better check for animated href attributes, thanks @​llamakko
  • Updated and improved the bundled types, thanks @​ssi02014
  • Updated several tests to better align with new browser encoding behaviors
  • Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
  • Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq
Commits
  • 5e56114 Getting 3.x branch ready for 3.3.2 release (#1208)
  • e8c95f4 fix: Fixed the broken package-lock.json
  • 9636037 Update package-lock.json
  • 5cad4ce Getting 3.x branch ready for 3.3.2 releas (#1205)
  • 6fc446a Merge pull request #1175 from cure53/main
  • 3b3bf91 Merge branch 'main' of github.com:cure53/DOMPurify
  • 9863f41 chore: Preparing 3.3.1 release
  • b4e0295 chore: Preparing 3.3.0 release
  • 077746b build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1170)
  • 4de68bb build(deps): bump actions/checkout from 5 to 6 (#1171)
  • Additional commits viewable in compare view

Copilot AI review requested due to automatic review settings March 5, 2026 17:37
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 5, 2026
@dependabot dependabot bot requested a review from a team as a code owner March 5, 2026 17:37
@dependabot dependabot bot added javascript Pull requests that update Javascript code dependencies Pull requests that update a dependency file labels Mar 5, 2026
@dependabot dependabot bot review requested due to automatic review settings March 5, 2026 17:37
@dependabot dependabot bot added the javascript Pull requests that update Javascript code label Mar 5, 2026
@github-actions github-actions bot added chore react Changes affect packages/react labels Mar 5, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 5, 2026

✅ No New Circular Dependencies

No new circular dependencies detected. Current count: 0

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 5, 2026

📦 Alpha Package Version Published

Use pnpm i github:factorialco/f0#npm/alpha-pr-3595 to install the package

Use pnpm i github:factorialco/f0#efa2e2c02fb74c9b93d4407a3ff40a119e5260d3 to install this specific commit

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 5, 2026

🔍 Visual review for your branch is published 🔍

Here are the links to:

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 5, 2026

Coverage Report for packages/react

Status Category Percentage Covered / Total
🔵 Lines 44.47% 10567 / 23757
🔵 Statements 43.76% 10886 / 24874
🔵 Functions 36.57% 2396 / 6551
🔵 Branches 36.04% 6771 / 18784
File CoverageNo changed files found.
Generated in workflow #12371 for commit c762861 by the Vitest Coverage Report Action

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/dompurify-3.3.2 branch from 6910e54 to 5e50fdf Compare March 26, 2026 16:50
@dependabot dependabot bot requested review from Copilot and removed request for Copilot March 26, 2026 16:50
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.2.6 to 3.3.2.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.2.6...3.3.2)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.3.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI review requested due to automatic review settings March 30, 2026 19:02
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/dompurify-3.3.2 branch from 5e50fdf to c762861 Compare March 30, 2026 19:02
@dependabot dependabot bot review requested due to automatic review settings March 30, 2026 19:02
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 1, 2026

Looks like dompurify is up-to-date now, so this is no longer needed.

@dependabot dependabot bot closed this Apr 1, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/dompurify-3.3.2 branch April 1, 2026 08:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

chore dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code react Changes affect packages/react

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants