Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 21, 2025

Bumps dompurify to 3.3.0 and updates ancestor dependency @redocly/cli. These dependencies need to be updated together.

Updates dompurify from 2.4.5 to 3.3.0

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.0

  • Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
  • Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
  • Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren

DOMPurify 3.2.7

  • Added new attributes and elements to default allow-list, thanks @​elrion018
  • Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
  • Added better check for animated href attributes, thanks @​llamakko
  • Updated and improved the bundled types, thanks @​ssi02014
  • Updated several tests to better align with new browser encoding behaviors
  • Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
  • Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

DOMPurify 3.2.6

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year

DOMPurify 3.2.3

DOMPurify 3.2.2

  • Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @​yaniv-git
  • Fixed several minor issues with the type definitions, thanks again @​reduckted
  • Fixed a minor issue with the types reference for trusted types, thanks @​reduckted
  • Fixed a minor problem with the template detection regex on some systems, thanks @​svdb99

... (truncated)

Commits
  • 36d1fbc Getting 3.x branch ready for 3.3.0 release (#1157)
  • eaa0bdb Merge pull request #1144 from cure53/main
  • f712593 fix: removed a possibly dossy regex
  • eb9b3b6 Merge branch 'main' of github.com:cure53/DOMPurify
  • ce006f7 chore: Preparing 3.2.7 release
  • ef0e0cb chore: Preparing 3.2.6 release
  • 2f09cd3 Update README.md
  • 6a795bc Merge pull request #1142 from cure53/dependabot/github_actions/actions/setup-...
  • 2458bbd build(deps): bump actions/setup-node from 4 to 5
  • e43d3f3 Merge pull request #1136 from cure53/dependabot/github_actions/actions/checko...
  • Additional commits viewable in compare view

Updates @redocly/cli from 1.0.0-beta.128 to 1.34.5

Changelog

Sourced from @​redocly/cli's changelog.

1.34.5 (2025-07-21)

Patch Changes

  • Updated form-data to 4.0.4 for Redocly CLI v1.
  • Updated @​redocly/respect-core to v1.34.5.

1.34.4 (2025-06-27)

Patch Changes

  • Resolved an issue where [email protected] injected an unintended message into the output.
  • Updated @​redocly/respect-core to v1.34.4.

1.34.3 (2025-04-22)

Patch Changes

  • Updated Redoc to v2.5.0.
  • Updated @​redocly/openapi-core to v1.34.3.

1.34.2 (2025-04-09)

Patch Changes

  • Updated @​redocly/openapi-core to v1.34.2.

1.34.1 (2025-03-29)

Patch Changes

  • Improved OpenTelemetry data serialization.
  • Updated @​redocly/respect-core to v1.34.1.

1.34.0 (2025-03-19)

Minor Changes

  • Added global execution timeout timer to respect command execution to prevent infinite test runs. You can configure this timer using the RESPECT_TIMEOUT environment variable (defaults to 1 hour).

Patch Changes

  • Updated @​redocly/respect-core to v1.34.0.

1.33.1 (2025-03-11)

Patch Changes

  • Fixed generate-arazzo command to properly handle output file paths. The output-file parameter must have a value when provided.
  • Updated @​redocly/respect-core to v1.33.1.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 21, 2025
@dependabot dependabot bot requested a review from a team as a code owner November 21, 2025 19:41
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 21, 2025
@netlify
Copy link

netlify bot commented Nov 21, 2025

Deploy Preview for open-api ready!

Name Link
🔨 Latest commit 1a473da
🔍 Latest deploy log https://app.netlify.com/projects/open-api/deploys/69257471e7513a000819f02d
😎 Deploy Preview https://deploy-preview-596--open-api.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Bumps [dompurify](https://github.com/cure53/DOMPurify) to 3.3.0 and updates ancestor dependency [@redocly/cli](https://github.com/Redocly/redocly-cli). These dependencies need to be updated together.


Updates `dompurify` from 2.4.5 to 3.3.0
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@2.4.5...3.3.0)

Updates `@redocly/cli` from 1.0.0-beta.128 to 1.34.5
- [Release notes](https://github.com/Redocly/redocly-cli/releases)
- [Changelog](https://github.com/Redocly/redocly-cli/blob/@redocly/[email protected]/docs/changelog.md)
- [Commits](https://github.com/Redocly/redocly-cli/compare/v1.0.0-beta.128...@redocly/[email protected])

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.3.0
  dependency-type: indirect
- dependency-name: "@redocly/cli"
  dependency-version: 1.34.5
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/multi-04437c27db branch from 9800e9a to 1a473da Compare November 25, 2025 09:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant