Added better configurability for comment scrubbing default behavior
Added better hardening against Prototype Pollution attacks, thanks @kevin-mizu
Added better handling and readability of the nodeType property, thanks @ssi02014
Fixed some smaller issues in README and other documentation
DOMPurify 3.1.2
Addressed and fixed a mXSS variation found by @kevin-mizu
Addressed and fixed a mXSS variation found by Adam Kues of Assetnote
Updated tests for older Safari and Chrome versions
DOMPurify 3.1.1
Fixed an mXSS sanitiser bypass reported by @icesfont
Added new code to track element nesting depth
Added new code to enforce a maximum nesting depth of 255
Added coverage tests and necessary clobbering protections
Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.
DOMPurify 3.1.0
Added new setting SAFE_FOR_XML to enable better control over comment scrubbing
Updated README to warn about happy-dom not being safe for use with DOMPurify yet
Updated the LICENSE file to show the accurate year number
Updated several build and test dependencies
DOMPurify 3.0.11
Fixed another conditional bypass caused by Processing Instructions, thanks @Ry0taK
Fixed the regex for HTML Custom Element detection, thanks @AlekseySolovey3T
DOMPurify 3.0.10
Fixed two possible bypasses when sanitizing an XML document and later using it in HTML, thanks @Slonser
Rename unstable_patchRoutesOnMiss to unstable_patchRoutesOnNavigation to match new behavior (#11888)
Updated dependencies:
@remix-run/router@1.19.1
react-router@6.26.1
6.26.0
Minor Changes
Add a new replace(url, init?) alternative to redirect(url, init?) that performs a history.replaceState instead of a history.pushState on client-side navigation redirects (#11811)
Patch Changes
Fix initial hydration behavior when using future.v7_partialHydration along with unstable_patchRoutesOnMiss (#11838)
During initial hydration, router.state.matches will now include any partial matches so that we can render ancestor HydrateFallback components
Updated dependencies:
@remix-run/router@1.19.0
react-router@6.26.0
6.25.1
Patch Changes
Memoize some RouterProvider internals to reduce unnecessary re-renders (#11803)
Updated dependencies:
react-router@6.25.1
6.25.0
Minor Changes
Stabilize future.unstable_skipActionErrorRevalidation as future.v7_skipActionErrorRevalidation (#11769)
When this flag is enabled, actions will not automatically trigger a revalidation if they return/throw a Response with a 4xx/5xx status code
You may still opt-into revalidation via shouldRevalidate
This also changes shouldRevalidate's unstable_actionStatus parameter to actionStatus
When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.
Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.
v4.3.0
Fix support for React compiler
Don't set retainLines: true when the React compiler is used. This creates whitespace issues and the compiler is modifying the JSX too much to get correct line numbers after that. If you want to use the React compiler and get back correct line numbers for tools like vite-plugin-react-click-to-component to work, you should update your config to something like:
export default defineConfig(({ command }) => {
const babelPlugins = [['babel-plugin-react-compiler', {}]]
if (com...
_Description has been truncated_
dependabot[bot]
commented
2 months ago
Bumps the node-requirements group with 18 updates in the /frontend directory:
8.112.58.120.79.37.39.54.139.7.39.7.41.0.0-beta.20240610.11.0.0-beta.20240814.13.0.63.1.63.0.43.0.56.23.16.26.10.20.20.23.29.5.09.9.118.3.318.3.44.1.14.3.18.57.09.9.17.34.37.35.015.6.015.9.03.0.33.3.35.4.55.5.47.13.18.3.04.5.35.4.2Updates
@fluentui/reactfrom 8.112.5 to 8.120.7Release notes
Sourced from
@fluentui/react's releases.Commits
769d5f4release: applying package updates - react v80c3ba3brelease: applying package updates - web-components95e64e8Carousel: Drag scroll (#32388)bfa731bfeat: adjust slider's sliding range (#32350)4b0f902fix: remove aria-valuenow from native input element (#32360)c1f74b4fix(react-tag-picker): Tag picker a11y bugs (#32297)5c671b3test(react-color-picker): added tests for ColorSlider (#32373)99348c8fix: SplitButton menuButton is at least 24px wide (#32309)6bc0d22fix(public-docsite-v9): subcomponents prop docs are not visible on docsite (#...854fe51TeachingPopover: Fix popover width and image bounds (#32363)Updates
@fluentui/react-componentsfrom 9.37.3 to 9.54.13Release notes
Sourced from
@fluentui/react-components's releases.Commits
c12f81arelease: applying package updates - react-componentsba889a0feat: Add context to configure motion behaviour (#32316)c1fe1f9V0 migration: Export VideoProps, split storybooks (#32318)2c5eaa8chore: update CODEOWNERS for react-tabs component (#32314)60e80c1chore: cleanup root npm script aliases and obsolete code (#32286)fee6435release: applying package updates - react v8f346161release: applying package updates - web-components8492a7echore(web-components): removewebtypes (#32308)2eac169Add gradient palette & rounded corners to Charting (#32008)3d0b259fix(web-components): export BaseCheckbox (#32302)Updates
@fluentui/react-iconsfrom 2.0.221 to 2.0.256Commits
Updates
@react-spring/webfrom 9.7.3 to 9.7.4Release notes
Sourced from
@react-spring/web's releases.... (truncated)
Commits
fd65b60v9.7.4d64fc47fix(shared): add rafz as a packagea755bd8fix: adduseReducedMotioncompatibility for Safari 13 and older (#2300)f96db5eRevert "chore(deps): update dependency remark-mdx-frontmatter to v5 (#2298)"28a172dchore(deps): update dependency remark-mdx-frontmatter to v5 (#2298)1e4406echore(deps): update dependency tsx to v4 (#2260)58d06b8chore: make deps absolute (#2283)f6047e4chore(deps): update github artifact actions to v4 (major) (#2262)84ed1dbchore(deps): update testing deps (#2282)da2c12echore: update tooling depsUpdates
@microsoft/ai-chat-protocolfrom 1.0.0-beta.20240610.1 to 1.0.0-beta.20240814.1Commits
5d138c9Fixing issue on how options were being applied to the request. (#72)b16639fUpdate README.md (#68)83324ebAdding file support (#59)1138f79Bump System.Text.Json from 8.0.3 to 8.0.4 in /samples/backend/csharp (#67)6b02568Update spec and samples to jsonl MIME type (#65)a57d9daBump braces from 3.0.2 to 3.0.3 in /spec (#61)5101521Bump braces from 3.0.2 to 3.0.3 in /sdk/js/packages/client (#60)65b188fUpdate samples README.md (#58)56dfd28Update README.md (#49)2451159Update main README with more samples and also add README for in-repo samples ...Updates
dompurifyfrom 3.0.6 to 3.1.6Release notes
Sourced from dompurify's releases.
... (truncated)
Commits
4083a90Merge pull request #978 from cure53/main90a10a1fix: Fixed a typo on the README65df042chore: Preparing 3.1.6 release6e03334fix: Made sure that remove() is not called directly from node00fc06cfix: Fixed a DOM clobbering issue leading to an error being thrownf8c2ef5Merge pull request #977 from cure53/dependabot/npm_and_yarn/multi-99ca4f73d8e5112ecbuild(deps): bump ws and socket.io-adapter9978cecdocs: Added better security warning about SAFE_FOR_XML to READMEfa542dffix: Changed the order for attribute checks slightly for safer hooksb8b552cMerge pull request #975 from cure53/dependabot/npm_and_yarn/multi-2d3aef8690Updates
@types/dompurifyfrom 3.0.4 to 3.0.5Commits
Updates
react-router-domfrom 6.23.1 to 6.26.1Release notes
Sourced from react-router-dom's releases.
... (truncated)
Changelog
Sourced from react-router-dom's changelog.
... (truncated)
Commits
04d09c3chore: Update version for release (#11895)f806fa4chore: Update version for release (pre) (#11889)5a6545bRename patchRoutesOnMiss to patchRoutesOnNavigation (#11888)91ef146chore: Update version for release (#11863)7acbfbechore: Update version for release (pre) (#11860)8334033chore: Update version for release (pre) (#11854)653d1a8Fix hydration behavior of patchRoutesOnMiss when v7_partialHydration is enabl...01d0f41Add support for replace() redirects (#11811)98941f8chore: Update version for release (#11815)db24ec9chore: Update version for release (pre) (#11814)Updates
schedulerfrom 0.20.2 to 0.23.2Commits
Maintainer changes
This version was pushed to npm by react-bot, a new releaser for scheduler since your current version.
Updates
@eslint/jsfrom 9.5.0 to 9.9.1Release notes
Sourced from
@eslint/js's releases.... (truncated)
Changelog
Sourced from
@eslint/js's changelog.... (truncated)
Commits
cd5a0dachore: package.json update for@eslint/jsrelease59dba1bchore: package.json update for@eslint/jsrelease4aaf2b3chore: package.json update for@eslint/jsrelease2570051chore: package.json revert@eslint/jsversion to 9.7.0 (#18719)d73b203chore: package.json update for@eslint/jsrelease7ed6f9achore: package.json update for@eslint/jsreleased655503chore: package.json update for@eslint/jsreleaseUpdates
@types/dompurifyfrom 3.0.4 to 3.0.5Commits
Updates
@types/reactfrom 18.3.3 to 18.3.4Commits
Updates
@vitejs/plugin-reactfrom 4.1.1 to 4.3.1Release notes
Sourced from
@vitejs/plugin-react's releases.