Added better configurability for comment scrubbing default behavior
Added better hardening against Prototype Pollution attacks, thanks @kevin-mizu
Added better handling and readability of the nodeType property, thanks @ssi02014
Fixed some smaller issues in README and other documentation
DOMPurify 3.1.2
Addressed and fixed a mXSS variation found by @kevin-mizu
Addressed and fixed a mXSS variation found by Adam Kues of Assetnote
Updated tests for older Safari and Chrome versions
DOMPurify 3.1.1
Fixed an mXSS sanitiser bypass reported by @icesfont
Added new code to track element nesting depth
Added new code to enforce a maximum nesting depth of 255
Added coverage tests and necessary clobbering protections
Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.
DOMPurify 3.1.0
Added new setting SAFE_FOR_XML to enable better control over comment scrubbing
Updated README to warn about happy-dom not being safe for use with DOMPurify yet
Updated the LICENSE file to show the accurate year number
Updated several build and test dependencies
DOMPurify 3.0.11
Fixed another conditional bypass caused by Processing Instructions, thanks @Ry0taK
Fixed the regex for HTML Custom Element detection, thanks @AlekseySolovey3T
DOMPurify 3.0.10
Fixed two possible bypasses when sanitizing an XML document and later using it in HTML, thanks @Slonser
When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.
Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.
v4.3.0
Fix support for React compiler
Don't set retainLines: true when the React compiler is used. This creates whitespace issues and the compiler is modifying the JSX too much to get correct line numbers after that. If you want to use the React compiler and get back correct line numbers for tools like vite-plugin-react-click-to-component to work, you should update your config to something like:
This is a long overdue and should fix some issues people had with HMR when migrating from CRA.
v4.2.1
Remove generic parameter on Plugin to avoid type error with Rollup 4/Vite 5 and skipLibCheck: false.
I expect very few people to currently use this feature, but if you are extending the React plugin via api object, you can get back the typing of the hook by importing ViteReactPluginApi:
import type { Plugin } from 'vite'
import type { ViteReactPluginApi } from '@vitejs/plugin-react'
When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.
Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.
4.3.0 (2024-05-22)
Fix support for React compiler
Don't set retainLines: true when the React compiler is used. This creates whitespace issues and the compiler is modifying the JSX too much to get correct line numbers after that. If you want to use the React compiler and get back correct line numbers for tools like vite-plugin-react-click-to-component to work, you should update your config to something like:
This is a long overdue and should fix some issues people had with HMR when migrating from CRA.
4.2.1 (2023-12-04)
Remove generic parameter on Plugin to avoid type error with Rollup 4/Vite 5 and skipLibCheck: false.
I expect very few people to currently use this feature, but if you are extending the React plugin via api object, you can get back the typing of the hook by importing ViteReactPluginApi:
import type { Plugin } from 'vite'
import type { ViteReactPluginApi } from '@vitejs/plugin-react'
Bumps the node-requirements group with 16 updates in the /frontend directory:
8.112.58.119.39.37.39.54.69.7.39.7.43.0.63.1.63.0.43.0.56.23.16.25.10.20.20.23.29.5.09.7.04.1.14.3.18.57.09.7.07.34.37.35.015.6.015.8.03.0.33.3.35.4.55.5.47.13.17.17.04.5.35.3.4Updates
@fluentui/reactfrom 8.112.5 to 8.119.3Release notes
Sourced from
@fluentui/react's releases.Commits
02db285release: applying package updates - react v88303652release: applying package updates - web-components233720fChore: Create Divider base class to abstract out style and layout specific ap...5c3c0bafix(TimePicker): Clear text when date value changes to null (#31626)1bfb9c9fix(web-components): move spinner animation off of mainthread (#32056)0c3c4acchore: unify jest maxWorkers usage on CI and turn off code coverage (#27680)5333195ci(vrt): install vr-app as part of standard yarn install and remedy necessary...ba0b6c5chore: remove component poster (#32057)651b92eci(vrt): upgrade VR tool to be security compliant (#31997)bae6b88ci: improve codeql performance by not analyzing sourcefiles that cause infint...Updates
@fluentui/react-componentsfrom 9.37.3 to 9.54.6Release notes
Sourced from
@fluentui/react-components's releases.Commits
e55fcebrelease: applying package updates - react-components970bf5c[Chore]: Create Spinner base class to abstract out style and layout specific ...60952ac[Chore]: Create Progress Bar base class to abstract out style and layout spec...9b99a9dfix(react-storybook-addon): transform decorator to function in withAriaLive()...ace4b73fix(motion): improve Web Animations API detection in tests (#32029)5e3705dchore(eslint-plugin): removes type dependency on@fluentui/react-utilitiesin...02db285release: applying package updates - react v88303652release: applying package updates - web-components233720fChore: Create Divider base class to abstract out style and layout specific ap...5c3c0bafix(TimePicker): Clear text when date value changes to null (#31626)Updates
@fluentui/react-iconsfrom 2.0.221 to 2.0.249Commits
Updates
@react-spring/webfrom 9.7.3 to 9.7.4Release notes
Sourced from
@react-spring/web's releases.... (truncated)
Commits
fd65b60v9.7.4d64fc47fix(shared): add rafz as a packagea755bd8fix: adduseReducedMotioncompatibility for Safari 13 and older (#2300)f96db5eRevert "chore(deps): update dependency remark-mdx-frontmatter to v5 (#2298)"28a172dchore(deps): update dependency remark-mdx-frontmatter to v5 (#2298)1e4406echore(deps): update dependency tsx to v4 (#2260)58d06b8chore: make deps absolute (#2283)f6047e4chore(deps): update github artifact actions to v4 (major) (#2262)84ed1dbchore(deps): update testing deps (#2282)da2c12echore: update tooling depsUpdates
dompurifyfrom 3.0.6 to 3.1.6Release notes
Sourced from dompurify's releases.
... (truncated)
Commits
4083a90Merge pull request #978 from cure53/main90a10a1fix: Fixed a typo on the README65df042chore: Preparing 3.1.6 release6e03334fix: Made sure that remove() is not called directly from node00fc06cfix: Fixed a DOM clobbering issue leading to an error being thrownf8c2ef5Merge pull request #977 from cure53/dependabot/npm_and_yarn/multi-99ca4f73d8e5112ecbuild(deps): bump ws and socket.io-adapter9978cecdocs: Added better security warning about SAFE_FOR_XML to READMEfa542dffix: Changed the order for attribute checks slightly for safer hooksb8b552cMerge pull request #975 from cure53/dependabot/npm_and_yarn/multi-2d3aef8690Updates
@types/dompurifyfrom 3.0.4 to 3.0.5Commits
Updates
react-router-domfrom 6.23.1 to 6.25.1Release notes
Sourced from react-router-dom's releases.
... (truncated)
Changelog
Sourced from react-router-dom's changelog.
... (truncated)
Commits
98941f8chore: Update version for release (#11815)db24ec9chore: Update version for release (pre) (#11814)a252428Reduce RouterProvider re-renders when using View Transitions (#11803)6b8daf9Revert "Temporary change to test release process off v6 branch"b8a4cdbTemporary change to test release process off v6 branch13dfa13chore: Update version for release (#11807)21b61c0chore: Update version for release (pre) (#11800)7b22365Stabilize future.unstable_skipActionErrorRevalidation (#11769)da65120Fix useMatch undecoded params (#11789)0a87644chore: Update version for release (#11767)Updates
schedulerfrom 0.20.2 to 0.23.2Commits
Maintainer changes
This version was pushed to npm by react-bot, a new releaser for scheduler since your current version.
Updates
@eslint/jsfrom 9.5.0 to 9.7.0Release notes
Sourced from
@eslint/js's releases.Changelog
Sourced from
@eslint/js's changelog.Commits
7ed6f9achore: package.json update for@eslint/jsreleased655503chore: package.json update for@eslint/jsreleaseUpdates
@types/dompurifyfrom 3.0.4 to 3.0.5Commits
Updates
@vitejs/plugin-reactfrom 4.1.1 to 4.3.1Release notes
Sourced from
@vitejs/plugin-react's releases.... (truncated)
Changelog
Sourced from
@vitejs/plugin-react's changelog.... (truncated)
Commits
1609186release: plugin-react@4.3.1ea647d1fix: handle using compiler with React 18 (#330)7e7322arelease: plugin-react@4.3.04b4a95cfix: don't use retainLines with react compiler (#319)2b7f2aefix: support HMR for class components (#320)302a323docs: add minimum react version (#321)Superseded by #61.