Addressed and fixed a mXSS variation found by @kevin-mizu
Addressed and fixed a mXSS variation found by Adam Kues of Assetnote
Updated tests for older Safari and Chrome versions
DOMPurify 3.1.1
Fixed an mXSS sanitiser bypass reported by @icesfont
Added new code to track element nesting depth
Added new code to enforce a maximum nesting depth of 255
Added coverage tests and necessary clobbering protections
Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.
Add a new unstable_dataStrategy configuration option (#11098)
This option allows Data Router applications to take control over the approach for executing route loaders and actions
The default implementation is today's behavior, to fetch all loaders in parallel, but this option allows users to implement more advanced data flows including Remix single-fetch, middleware/context APIs, automatic loader caching, and more
Bumps the dev-dependencies group with 16 updates in the / directory:
5.16.2
5.16.5
3.1.0
3.1.2
10.11.0
10.11.1
12.0.1
12.0.2
18.2.0
18.3.1
18.2.79
18.3.1
18.2.0
18.3.1
18.2.25
18.3.0
6.22.3
6.23.0
15.0.2
15.0.5
7.7.0
7.8.0
7.7.0
7.8.0
1.5.0
1.5.3
8.57.0
9.1.1
4.6.0
4.6.2
5.2.9
5.2.10
Updates
antd
from 5.16.2 to 5.16.5Release notes
Sourced from antd's releases.
... (truncated)
Changelog
Sourced from antd's changelog.
Commits
1a6e9e0
docs: changelog v5.16.5 (#48676)029cb1d
test: rm legacyreact-dom/test-utils
for compatible React-18.3.1 (#48667)f799219
fix: ajust the input border style in validation (#48616)cb19e0e
fix: fix transfer when trying to select item from the right column while it h...dfaf6ba
chore(deps-dev): bump react from 18.2.0 to 18.3.0 (#48666)aa5d3bd
chore(deps-dev): bump the dev-dependencies group with 3 updates (#48665)b173ce1
docs: add names demo (#48488)c8bd145
fix(step): custom icon not vertically centered error (#48650)2afb721
site: Replace card deprecated API 'bodyStyle' (#48644)409a227
🔒 ci: locked React version (#48640)Updates
dompurify
from 3.1.0 to 3.1.2Release notes
Sourced from dompurify's releases.
Commits
5b2e317
Merge pull request #945 from cure53/main74664db
chore: Updated package-lock.json with new release number5f17b27
chore: Preparing 3.1.2 release5d492ee
test: Fixed the tests for older Chrome and Safari8075b37
fix: Adjusted the list of permitted SVG HTML integration points61b761f
fix: Switched to using the getParentNode API for some callsee17313
docs: Added new mentions of honor to the readme7a0a984
Merge pull request #944 from cure53/main7bbd12b
chore: Preparing 3.1.1 release87eff29
Merge branch 'main' of github.com:cure53/DOMPurifyUpdates
firebase
from 10.11.0 to 10.11.1Commits
7709f10
Version Packages (#8202)e16d613
Merge master into releasee1a7764
Go back using xmlhttprequest for bidi-streams (#8197)36b283f
Emit a module package file into esm2017 auth webextension bundle (#8191)62a20ff
Update bug_report_v2.yaml (#8199)03069bb
Fix typo and link formatting in contribution guide (#8183)f24c953
Update recommended Node version for development (#8188)b74d8a2
Bump async from 3.2.0 to 3.2.4 in /e2e (#6447)02b4ea9
Bump shell-quote from 1.7.2 to 1.7.3 (#6381)71ab2f5
Bump ua-parser-js from 0.7.31 to 0.7.37 (#8179)Updates
marked
from 12.0.1 to 12.0.2Release notes
Sourced from marked's releases.
Commits
c6a98ea
chore(release): 12.0.2 [skip ci]e9f0eed
fix: fix Setext continuation in blockquote (#3257)a90223b
chore(deps-dev): Bump@typescript-eslint/eslint-plugin
from 7.4.0 to 7.6.0 (#...7757f96
chore(deps-dev): Bump typescript from 5.4.4 to 5.4.5 (#3261)609b65c
chore(deps-dev): Bump@arethetypeswrong/cli
from 0.15.2 to 0.15.3 (#3258)dfa835e
chore(deps-dev): Bump rollup from 4.14.1 to 4.14.3 (#3259)f0fb744
chore(deps-dev): Bump semantic-release from 23.0.6 to 23.0.7 (#3255)924130d
chore(deps-dev): Bump@semantic-release/github
from 10.0.2 to 10.0.3 (#3254)8cdb7ca
chore(deps-dev): Bump rollup from 4.13.2 to 4.14.1 (#3253)1cc9eb2
chore(deps-dev): Bump typescript from 5.4.3 to 5.4.4 (#3252)Updates
react
from 18.2.0 to 18.3.1Release notes
Sourced from react's releases.
Changelog
Sourced from react's changelog.
Commits
f1338f8
ExportReact.act
from 18.3d6c42f7
Bump to 18.3.173bfaa1
Turn on key spread warning in jsx-runtime for everyone (#25697)c2a246e
Turn on string ref deprecation warning for everybody (not codemoddable) (#25383)2cfb474
Bump version from 18.2 to 18.3Maintainer changes
This version was pushed to npm by react-bot, a new releaser for react since your current version.
Updates
@types/react
from 18.2.79 to 18.3.1Commits
Updates
react-dom
from 18.2.0 to 18.3.1Release notes
Sourced from react-dom's releases.
Changelog
Sourced from react-dom's changelog.
Commits
d6c42f7
Bump to 18.3.18a015b6
Add deprecation warning for unmountComponentAtNodec3b2839
Add deprecation warning for findDOMNoded4ea75d
ReactDOMTestUtils deprecation warnings7548c01
DeprecaterenderToStaticNodeStream
(#28872) (#28874)5894232
Enable warning for defaultProps on function components for everyone (#25699)c2a246e
Turn on string ref deprecation warning for everybody (not codemoddable) (#25383)2cfb474
Bump version from 18.2 to 18.3Maintainer changes
This version was pushed to npm by react-bot, a new releaser for react-dom since your current version.
Updates
@types/react-dom
from 18.2.25 to 18.3.0Commits
Updates
react-router-dom
from 6.22.3 to 6.23.0Release notes
Sourced from react-router-dom's releases.
... (truncated)
Changelog
Sourced from react-router-dom's changelog.
Commits
82a3a77
chore: Update version for release (#11486)8a20f32
chore: Update version for release (pre) (#11387)88ec71a
chore: Update version for release (pre) (#11379)12afb2e
Migrate to pnpm (#11358)c7dd3d3
Data Strategy Configuration (#11098)Updates
@testing-library/react
from 15.0.2 to 15.0.5Release notes
Sourced from
@testing-library/react
's releases.Commits
f6a1677
chore: Adjust tests to workaround 18.3.0 bug (#1315)d143f46
fix: Stop restrictingcontainer
option based onhydrate
(#1313)48282c2
fix: EnsurerenderHook
options extend options forrender
(#1308)067d0c6
fix: Don't raise TypeScript errors when hydatingdocument
(#1304)Updates
@types/react
from 18.2.79 to 18.3.1Commits
Updates
@types/react-dom
from 18.2.25 to 18.3.0Commits
Updates
@typescript-eslint/eslint-plugin
from 7.7.0 to 7.8.0Release notes
Sourced from
@typescript-eslint/eslint-plugin
's releases.Changelog
Sourced from
@typescript-eslint/eslint-plugin
's changelog.Commits
ee677f6
chore(release): publish 7.8.08127873
fix(eslint-plugin): [no-unused-vars] clear error report range (#8640)216d1b0
fix(eslint-plugin): [no-unsafe-return] handle union types (#9001)51d2193
fix(eslint-plugin): [consistent-type-assertions] handle tagged templates (#8993)4bed24d
fix(eslint-plugin): [prefer-optional-chain] suggests optional chaining during...b0f7aa4
fix(eslint-plugin): [no-unsafe-argument] handle tagged templates (#8746)219b841
chore: resolve lint issues on main branch (#8966)3e19436
chore(release): publish 7.7.1b2552ca
fix(eslint-plugin): [no-unnecessary-type-assertion] allow non-null assertion ...fdeba42
fix(eslint-plugin): [no-for-in-array] refine report location (#8874)Updates
@typescript-eslint/parser
from 7.7.0 to 7.8.0Release notes
Sourced from
@typescript-eslint/parser
's releases.Changelog
Sourced from
@typescript-eslint/parser
's changelog.Commits
ee677f6
chore(release): publish 7.8.0This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.
To ignore these dependencies, configure ignore rules in dependabot.yml
Looks like these dependencies are updatable in another way, so this is no longer needed.