Addressed and fixed a mXSS variation found by @kevin-mizu
Addressed and fixed a mXSS variation found by Adam Kues of Assetnote
Updated tests for older Safari and Chrome versions
DOMPurify 3.1.1
Fixed an mXSS sanitiser bypass reported by @icesfont
Added new code to track element nesting depth
Added new code to enforce a maximum nesting depth of 255
Added coverage tests and necessary clobbering protections
Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the minor-patches group with 15 updates in the / directory:
1.1.78
1.1.79
2.5.6
2.5.7
0.5.12
0.5.13
7.7.0
7.8.0
7.7.0
7.8.0
0.4.0
0.5.0
4.10.1
4.10.5
1.11.10
1.11.11
3.1.0
3.1.2
2.37.0
2.38.0
1.3.0
1.4.0
4.2.14
4.2.15
3.6.9
3.7.1
4.27.4
4.27.19
5.2.8
5.2.11
Updates
@iconify-json/material-symbols
from 1.1.78 to 1.1.79Commits
6dc12d3
Update Material Design Icons, OpenMojiUpdates
@sveltejs/kit
from 2.5.6 to 2.5.7Release notes
Sourced from
@sveltejs/kit
's releases.Changelog
Sourced from
@sveltejs/kit
's changelog.Commits
c5d1e67
Version Packages (#12143)172db45
chore(deps): update dependency devalue to v5 (#12141)bd54aa1
feat: add self-closing-tags migration (#12128)Updates
@tailwindcss/typography
from 0.5.12 to 0.5.13Release notes
Sourced from
@tailwindcss/typography
's releases.Changelog
Sourced from
@tailwindcss/typography
's changelog.Commits
e21d9e6
0.5.13c0dea6c
Don't apply margins to\<br>
elements contained in an\<li>
in FF (#350)Updates
@typescript-eslint/eslint-plugin
from 7.7.0 to 7.8.0Release notes
Sourced from
@typescript-eslint/eslint-plugin
's releases.Changelog
Sourced from
@typescript-eslint/eslint-plugin
's changelog.Commits
ee677f6
chore(release): publish 7.8.08127873
fix(eslint-plugin): [no-unused-vars] clear error report range (#8640)216d1b0
fix(eslint-plugin): [no-unsafe-return] handle union types (#9001)51d2193
fix(eslint-plugin): [consistent-type-assertions] handle tagged templates (#8993)4bed24d
fix(eslint-plugin): [prefer-optional-chain] suggests optional chaining during...b0f7aa4
fix(eslint-plugin): [no-unsafe-argument] handle tagged templates (#8746)219b841
chore: resolve lint issues on main branch (#8966)3e19436
chore(release): publish 7.7.1b2552ca
fix(eslint-plugin): [no-unnecessary-type-assertion] allow non-null assertion ...fdeba42
fix(eslint-plugin): [no-for-in-array] refine report location (#8874)Updates
@typescript-eslint/parser
from 7.7.0 to 7.8.0Release notes
Sourced from
@typescript-eslint/parser
's releases.Changelog
Sourced from
@typescript-eslint/parser
's changelog.Commits
ee677f6
chore(release): publish 7.8.03e19436
chore(release): publish 7.7.1Updates
@vite-pwa/sveltekit
from 0.4.0 to 0.5.0Release notes
Sourced from
@vite-pwa/sveltekit
's releases.Commits
59d3a60
chore: release v0.5.05af044f
fix!: update vite-plugin-pwa dependency to 0.20.0 (#82)3ff8426
chore: include Remix in readme fileUpdates
daisyui
from 4.10.1 to 4.10.5Release notes
Sourced from daisyui's releases.
Changelog
Sourced from daisyui's changelog.
Commits
f5b5fd8
chore(release): 4.10.5b3e4800
fix: add missingoutline-*
color utility classes to CDN fileb4ef23f
workflowsb3cfb33
docs: move images to separate git9fe3370
Update src/docs/.enva7a1e9e
chore(release): 4.10.450d26b5
fix: show the parent element of disabledinput
as disabled829ec73
store4b7cdb8
Update src/docs/.enva4976a7
chore(release): 4.10.3Updates
dayjs
from 1.11.10 to 1.11.11Release notes
Sourced from dayjs's releases.
Changelog
Sourced from dayjs's changelog.
Commits
f9790ae
chore(release): 1.11.11 [skip ci]ccf947e
Merge pull request #2641 from iamkun/devf68d73e
fix: day of week type literal (#2630)0309582
chore: add french README.md (#2547)44b0936
fix: Update 'da' locale to match correct first week of year (#2592)2076da9
chore: Update README.mdbdcc336
chore: Update README.mdfa304a3
chore: Update README.mdf0c9a41
fix: update locale Bulgarian monthsShort Jan (#2538)43b62e0
chore: Update README.mdUpdates
dompurify
from 3.1.0 to 3.1.2Release notes
Sourced from dompurify's releases.
Commits
5b2e317
Merge pull request #945 from cure53/main74664db
chore: Updated package-lock.json with new release number5f17b27
chore: Preparing 3.1.2 release5d492ee
test: Fixed the tests for older Chrome and Safari8075b37
fix: Adjusted the list of permitted SVG HTML integration points61b761f
fix: Switched to using the getParentNode API for some callsee17313
docs: Added new mentions of honor to the readme7a0a984
Merge pull request #944 from cure53/main7bbd12b
chore: Preparing 3.1.1 release87eff29
Merge branch 'main' of github.com:cure53/DOMPurifyUpdates
eslint-plugin-svelte
from 2.37.0 to 2.38.0Release notes
Sourced from eslint-plugin-svelte's releases.
Changelog
Sourced from eslint-plugin-svelte's changelog.
Commits
481729c
chore: release eslint-plugin-svelte (#742)33626a3
feat: Follow latest Svelte 5 (#741)6e9329b
chore: fix test fixtures (#740)59944b8
chore: fix lint error1ce5774
chore: Use eslint v9 and flat config (#738)Updates
shiki
from 1.3.0 to 1.4.0Release notes
Sourced from shiki's releases.
Commits
044181d
chore: release v1.4.07cf4bce
chore: update snap26f37f0
feat: upgrade deps, new langs and themesUpdates
svelte
from 4.2.14 to 4.2.15Release notes
Sourced from svelte's releases.
Changelog
Sourced from svelte's changelog.
Commits
9f2341f
Version Packages (#11202)a510c6a
fix: support attribute selector inside :global() (#11135)Updates
svelte-check
from 3.6.9 to 3.7.1Release notes
Sourced from svelte-check's releases.
Commits
9d7907e
fix: rework bindable types strategy (#2361)6cfb0d2
fix: revert waiting for config request in ts plugin (#2352)8236f63
fix: load user's Svelte version in TS plugin (#2351)c924fba
fix: handle boolean css var (#2350)fcc148d
fix: betterbind:group
transformation (#2349)6aa40f7
fix: handle#await
inside#snippet
(#2348)a8e45c6
fix: volar ts plugin compatibility (#2317)d9e8948
fix: preserve event attribute casing in svelte 5 (#2347)957b8d6
chore: Bindable and Svelte 5 interop (#2336)4c8c0db
feat: editor support for ts 5.4 (#2334)Updates
tocbot
from 4.27.4 to 4.27.19Release notes
Sourced from tocbot's releases.
... (truncated)
Commits
cdc2378
4.27.193a54fb7
add types to files array2d167f3
4.27.184d1a837
Bump gh-pages from 4.0.0 to 5.0.0 (#339)98c7732
4.27.17bbdf897
fix for esm export (#343)5179dc2
4.27.1672c8967
revert type module change0107d80
4.27.155effb6b
update built filesUpdates
vite
from 5.2.8 to 5.2.11Changelog
Sourced from vite's changelog.
Commits
2bc5d3d
release: v5.2.11f8feeea
feat: improve dynamic import variable failure error message (#16519)c071eb3
fix(ssr): handle class declaration and expression name scoping (#16569)02db947
fix(ssr): handle function expression name scoping (#16563)2d6a13b
fix(deps): update all non-major dependencies (#16549)0e93f58
fix: scripts and styles were missing from built HTML on Windows (#16421)bb79c9b
fix(preload): skip preload for non-static urls (#16556)f71ba5b
fix: dynamic-import-vars plugin normalize path issue (#16518)2d50be2
fix(deps): update all non-major dependencies (#16488)4d83eb5
fix(dev): watch publicDir explicitly to include it outside the root (#16502)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show