Skip to content

Bump dompurify from 3.3.3 to 3.4.0#10

Open
dependabot[bot] wants to merge 85 commits into
mainfrom
dependabot/npm_and_yarn/dompurify-3.4.0
Open

Bump dompurify from 3.3.3 to 3.4.0#10
dependabot[bot] wants to merge 85 commits into
mainfrom
dependabot/npm_and_yarn/dompurify-3.4.0

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 16, 2026

Bumps dompurify from 3.3.3 to 3.4.0.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

  • Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
  • Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
  • Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
  • Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
  • Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
  • Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
  • Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth
  • Fixed an issue with USE_PROFILES prototype pollution, thanks @​christos-eth
  • Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @​researchatfluidattacks and others
  • Fixed an issue with closing tags leading to possible mXSS, thanks @​frevadiscor
  • Fixed a problem with the type dentition patcher after Node version bump
  • Fixed freezing BS runs by reducing the tested browsers array
  • Bumped several dependencies where possible
  • Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

phaupt added 30 commits March 15, 2026 11:53
Keeps documentation guidance concise, publishable, and aligned with helper/app behavior.
Directory structure created for docs/public/blog/{fonts,img,media}.
generated assets (infographic, video, audio, PDF) require manual download.
- Clear leaked setTimeout in PasskeyLoginFlow on unmount
- Make AcrLevels descriptions accessible on touch/keyboard
- Add keyboard navigation (arrow keys) to AudioPlayer seek bar
- Make VideoEmbed play trigger keyboard-accessible with ARIA
Watermarks cropped from all images.
…ment examples

- Add new configuration.md with complete customer config, LDAP, geofencing,
  Fortinet VSA, MFA mapping, OTP, events, I18N error messages, and error
  code reference (cross-checked against source code)
- Update deployment.md with inline docker-compose.yml, nginx.conf, env file
  examples, and single-node (no Redis) deployment section
- Expand introduction.md feature list with detailed descriptions and add
  single-node deployment architecture section
- Add configuration page to VitePress sidebar
Replace blog layout with dedicated release-notes section including
multi-language support (EN/DE/FR/IT), language switcher, and new
components (ScreenshotStep, HybridAuthComparisonTable). Convert heavy
infographic PNGs to WebP (~93% size reduction). Remove unused blog
assets, placeholder media, and empty blog post.
phaupt and others added 22 commits March 28, 2026 14:57
Remove descriptive paragraph from passkey-typen graphic and
rename Passkeys column header to MobileID Passkeys in
methoden-szenarien graphic.
Align admin role guidance with Microsoft docs: Authentication Policy
Administrator for method/policy config, Privileged Role Administrator
for admin consent. Reword sentence that conflated Entra External MFA,
standard OIDC, and RADIUS into a single flow.
Regenerated both infographics from NotebookLM with updated source context:
- passkey-typen: reduced text clutter, cleaner layout with icons and table
- methoden-szenarien: corrected column header to "Mobile ID Passkeys",
  added method icons (fingerprint, SIM card, smartphone)
Replace native select element with custom dropdown featuring country
flags, animated chevron, checkmark for active language, smooth
open/close transitions, and click-outside/escape dismissal.
Rewrite release notes layouts and CSS to integrate seamlessly with the
VitePress docs theme. Key changes:

- Replace gradient hero and blog-specific typography with clean card feed
  using VitePress design tokens
- Fix content alignment: pull post grid into VPContent padding area so
  article text starts at the same horizontal position as doc pages
- Add VideoEmbed component to fix video loading on SPA navigation
- Convert language switcher from dropdown to inline segmented control
- Add custom sidebar navigation matching VitePress sidebar visual style
- Replicate has-sidebar CSS rules for navbar/content positioning on
  release notes pages via html.rn-page class toggle
Clarify mixed DTBD array behavior for _any ACR flows and add documentation for mid_pk_aal3 and mid_profile_signer_cert_chain claims in OIDC guides.
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.3.3 to 3.4.0.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.3...3.4.0)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 16, 2026
@phaupt phaupt force-pushed the main branch 3 times, most recently from 453cb13 to 0c9692d Compare April 17, 2026 05:48
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 22, 2026

A newer version of dompurify exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Development

Successfully merging this pull request may close these issues.

1 participant