Added better configurability for comment scrubbing default behavior
Added better hardening against Prototype Pollution attacks, thanks @kevin-mizu
Added better handling and readability of the nodeType property, thanks @ssi02014
Fixed some smaller issues in README and other documentation
DOMPurify 3.1.2
Addressed and fixed a mXSS variation found by @kevin-mizu
Addressed and fixed a mXSS variation found by Adam Kues of Assetnote
Updated tests for older Safari and Chrome versions
DOMPurify 3.1.1
Fixed an mXSS sanitiser bypass reported by @icesfont
Added new code to track element nesting depth
Added new code to enforce a maximum nesting depth of 255
Added coverage tests and necessary clobbering protections
Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.
DOMPurify 3.1.0
Added new setting SAFE_FOR_XML to enable better control over comment scrubbing
Updated README to warn about happy-dom not being safe for use with DOMPurify yet
Updated the LICENSE file to show the accurate year number
Updated several build and test dependencies
DOMPurify 3.0.11
Fixed another conditional bypass caused by Processing Instructions, thanks @Ry0taK
Fixed the regex for HTML Custom Element detection, thanks @AlekseySolovey3T
DOMPurify 3.0.10
Fixed two possible bypasses when sanitizing an XML document and later using it in HTML, thanks @Slonser
Add a new replace(url, init?) alternative to redirect(url, init?) that performs a history.replaceState instead of a history.pushState on client-side navigation redirects (#11811)
Patch Changes
Fix initial hydration behavior when using future.v7_partialHydration along with unstable_patchRoutesOnMiss (#11838)
During initial hydration, router.state.matches will now include any partial matches so that we can render ancestor HydrateFallback components
Updated dependencies:
@remix-run/router@1.19.0
react-router@6.26.0
6.25.1
Patch Changes
Memoize some RouterProvider internals to reduce unnecessary re-renders (#11803)
Updated dependencies:
react-router@6.25.1
6.25.0
Minor Changes
Stabilize future.unstable_skipActionErrorRevalidation as future.v7_skipActionErrorRevalidation (#11769)
When this flag is enabled, actions will not automatically trigger a revalidation if they return/throw a Response with a 4xx/5xx status code
You may still opt-into revalidation via shouldRevalidate
This also changes shouldRevalidate's unstable_actionStatus parameter to actionStatus
Patch Changes
Updated dependencies:
react-router@6.25.0
@remix-run/router@1.18.0
6.24.1
Patch Changes
Remove polyfill.io reference from warning message because the domain was sold and has since been determined to serve malware (#11741)
When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.
Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.
v4.3.0
Fix support for React compiler
Don't set retainLines: true when the React compiler is used. This creates whitespace issues and the compiler is modifying the JSX too much to get correct line numbers after that. If you want to use the React compiler and get back correct line numbers for tools like vite-plugin-react-click-to-component to work, you should update your config to something like:
This is a long overdue and should fix some issues people had with HMR when migrating from CRA.
v4.2.1
Remove generic parameter on Plugin to avoid type error with Rollup 4/Vite 5 and skipLibCheck: false.
I expect very few people to currently use this feature, but if you are extending the React plugin via api object, you can get back the typing of the hook by importing ViteReactPluginApi:
import type { Plugin } from 'vite'
import type { ViteReactPluginApi } from '@vitejs/plugin-react'
Bumps the node-requirements group with 16 updates in the /frontend directory:
8.112.5
8.120.3
9.37.3
9.54.10
9.7.3
9.7.4
3.0.6
3.1.6
3.0.4
3.0.5
6.23.1
6.26.0
0.20.2
0.23.2
9.5.0
9.9.0
4.1.1
4.3.1
8.57.0
9.9.0
7.34.3
7.35.0
15.6.0
15.9.0
3.0.3
3.3.3
5.4.5
5.5.4
7.13.1
8.0.1
4.5.3
5.4.0
Updates
@fluentui/react
from 8.112.5 to 8.120.3Release notes
Sourced from
@fluentui/react
's releases.Commits
e70848e
release: applying package updates - react v80c2c905
release: applying package updates - web-components0ce3c40
ci(bundlesize): bump monosize dependencies (#32242)c971f0f
[chore]: [rating-display] move size, color and compact. (#32239)e084a56
chore: add "@griffel/pseudo-element-naming
": "error" eslint rule (#32236)114f3e5
fix(workspace-plugin): remove swc-node@register dependency (#32254)ef15b5d
chore: migrate to storybook v7 (#32018)6d615a3
release: applying package updates - react-components6ce9dc9
ci: make public-docsite-v9 deploy pipeline work and make it faster (#32248)0c43a22
fix(Toolbar): hardcode size ofToolbarButton
(#32185)Updates
@fluentui/react-components
from 9.37.3 to 9.54.10Release notes
Sourced from
@fluentui/react-components
's releases.Commits
6d615a3
release: applying package updates - react-components6ce9dc9
ci: make public-docsite-v9 deploy pipeline work and make it faster (#32248)0c43a22
fix(Toolbar): hardcode size ofToolbarButton
(#32185)fc76da9
chore: deprecate@fluentui/react-motion-preview
(#32190)43ec035
release: applying package updates - web-componentsdc714f8
docs: add wrapping menu item example to ContextualMenu docs (#31289)0a15037
docs: update title of v8 keyboard-accessible drag & drop example, add docs (#...7f847ed
release: applying package updates - react-componentsedd3637
fix: Card does not override specified focusMode based on event listeners (#32...f239694
Fix undefined reference in older browsers in useMessageBarReflow (#32238)Updates
@fluentui/react-icons
from 2.0.221 to 2.0.253Commits
Updates
@react-spring/web
from 9.7.3 to 9.7.4Release notes
Sourced from
@react-spring/web
's releases.... (truncated)
Commits
fd65b60
v9.7.4d64fc47
fix(shared): add rafz as a packagea755bd8
fix: adduseReducedMotion
compatibility for Safari 13 and older (#2300)f96db5e
Revert "chore(deps): update dependency remark-mdx-frontmatter to v5 (#2298)"28a172d
chore(deps): update dependency remark-mdx-frontmatter to v5 (#2298)1e4406e
chore(deps): update dependency tsx to v4 (#2260)58d06b8
chore: make deps absolute (#2283)f6047e4
chore(deps): update github artifact actions to v4 (major) (#2262)84ed1db
chore(deps): update testing deps (#2282)da2c12e
chore: update tooling depsUpdates
dompurify
from 3.0.6 to 3.1.6Release notes
Sourced from dompurify's releases.
... (truncated)
Commits
4083a90
Merge pull request #978 from cure53/main90a10a1
fix: Fixed a typo on the README65df042
chore: Preparing 3.1.6 release6e03334
fix: Made sure that remove() is not called directly from node00fc06c
fix: Fixed a DOM clobbering issue leading to an error being thrownf8c2ef5
Merge pull request #977 from cure53/dependabot/npm_and_yarn/multi-99ca4f73d8e5112ec
build(deps): bump ws and socket.io-adapter9978cec
docs: Added better security warning about SAFE_FOR_XML to READMEfa542df
fix: Changed the order for attribute checks slightly for safer hooksb8b552c
Merge pull request #975 from cure53/dependabot/npm_and_yarn/multi-2d3aef8690Updates
@types/dompurify
from 3.0.4 to 3.0.5Commits
Updates
react-router-dom
from 6.23.1 to 6.26.0Release notes
Sourced from react-router-dom's releases.
... (truncated)
Changelog
Sourced from react-router-dom's changelog.
... (truncated)
Commits
91ef146
chore: Update version for release (#11863)7acbfbe
chore: Update version for release (pre) (#11860)8334033
chore: Update version for release (pre) (#11854)653d1a8
Fix hydration behavior of patchRoutesOnMiss when v7_partialHydration is enabl...01d0f41
Add support for replace() redirects (#11811)98941f8
chore: Update version for release (#11815)db24ec9
chore: Update version for release (pre) (#11814)a252428
Reduce RouterProvider re-renders when using View Transitions (#11803)6b8daf9
Revert "Temporary change to test release process off v6 branch"b8a4cdb
Temporary change to test release process off v6 branchUpdates
scheduler
from 0.20.2 to 0.23.2Commits
Maintainer changes
This version was pushed to npm by react-bot, a new releaser for scheduler since your current version.
Updates
@eslint/js
from 9.5.0 to 9.9.0Release notes
Sourced from
@eslint/js
's releases.... (truncated)
Changelog
Sourced from
@eslint/js
's changelog.... (truncated)
Commits
59dba1b
chore: package.json update for@eslint/js
release4aaf2b3
chore: package.json update for@eslint/js
release2570051
chore: package.json revert@eslint/js
version to 9.7.0 (#18719)d73b203
chore: package.json update for@eslint/js
release7ed6f9a
chore: package.json update for@eslint/js
released655503
chore: package.json update for@eslint/js
releaseUpdates
@types/dompurify
from 3.0.4 to 3.0.5Commits
Updates
@vitejs/plugin-react
from 4.1.1 to 4.3.1Release notes
Sourced from
@vitejs/plugin-react
's releases.... (truncated)
Changelog
Sourced from
@vitejs/plugin-react
's changelog.