Skip to content

Bump dompurify from 3.2.7 to 3.4.0#1301

Closed
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/npm_and_yarn/dompurify-3.4.0
Closed

Bump dompurify from 3.2.7 to 3.4.0#1301
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/npm_and_yarn/dompurify-3.4.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 16, 2026 •
edited
Loading

Bumps dompurify from 3.2.7 to 3.4.0.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

  • Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
  • Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
  • Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
  • Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
  • Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
  • Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
  • Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth
  • Fixed an issue with USE_PROFILES prototype pollution, thanks @​christos-eth
  • Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @​researchatfluidattacks and others
  • Fixed an issue with closing tags leading to possible mXSS, thanks @​frevadiscor
  • Fixed a problem with the type dentition patcher after Node version bump
  • Fixed freezing BS runs by reducing the tested browsers array
  • Bumped several dependencies where possible
  • Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

DOMPurify 3.3.3

  • Fixed an engine requirement for Node 20 which caused hiccups, thanks @​Rotzbua

DOMPurify 3.3.2

  • Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
  • Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
  • Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
  • Bumped and removed several dependencies, thanks @​Rotzbua
  • Fixed the test suite after bumping dependencies, thanks @​Rotzbua

DOMPurify 3.3.1

  • Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @​MariusRumpf
  • Updated the ESM import syntax to be more correct, thanks @​binhpv

DOMPurify 3.3.0

  • Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
  • Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
  • Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren
Commits
  • 5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
  • 8bcbf73 chore: Preparing 3.3.3 release
  • 5faddd6 fix: engine requirement (#1210)
  • 0f91e3a Update README.md
  • d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
  • c3efd48 fix: moved back from jsdom 28 to jsdom 20
  • 988b888 fix: moved back from jsdom 28 to jsdom 20
  • 2726c74 chore: Preparing 3.3.2 release
  • 6202c7e build(deps): bump @​tootallnate/once and jsdom (#1204)
  • 302b51d fix: Expanded the regex ever so slightly to also cover script
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 16, 2026
Copilot AI review requested due to automatic review settings April 16, 2026 03:01
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 16, 2026
@dependabot dependabot Bot review requested due to automatic review settings April 16, 2026 03:01
@dependabot dependabot Bot mentioned this pull request Apr 16, 2026
Closed
@dixpac
Copy link
Copy Markdown

dixpac commented May 2, 2026

@flavorjones would it be possible/safe to merge this and release 🙏. Since current version of dompurify is raising 9 security vulnerabilities(moderate)?

@dixpac
Copy link
Copy Markdown

dixpac commented May 4, 2026 •
edited
Loading

My bad fixed security issues by updating to the latest trix version(2.1.18). Sorry for spamming :)

@flavorjones
Copy link
Copy Markdown
Member

flavorjones commented May 9, 2026

@dependabot recreate

@dependabot
Bump dompurify from 3.2.7 to 3.4.0
5d1708a 
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.2.7 to 3.4.0.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.2.7...3.4.0)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI review requested due to automatic review settings May 9, 2026 15:46
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/dompurify-3.4.0 branch from 28c71a1 to 5d1708a Compare May 9, 2026 15:46
@dependabot dependabot Bot review requested due to automatic review settings May 9, 2026 15:46
Copilot AI review requested due to automatic review settings May 9, 2026 15:56
Copilot AI reviewed May 9, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the bundled DOMPurify version used by Trix (and the ActionText-Trix packaged asset) to incorporate upstream security fixes and behavior corrections.

Changes:

  • Update the lockfile to resolve dompurify from 3.2.7 to 3.4.0.
  • Regenerate the bundled action_text-trix JavaScript asset to embed DOMPurify 3.4.0 (including upstream sanitization fixes and config-handling changes).

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
yarn.lock Locks DOMPurify to 3.4.0 for reproducible installs.
action_text-trix/app/assets/javascripts/trix.js Updates the vendored/bundled DOMPurify code and version header to 3.4.0.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@flavorjones flavorjones mentioned this pull request May 9, 2026
Merged
@flavorjones
Copy link
Copy Markdown
Member

flavorjones commented May 9, 2026

Superseded by #1310

@flavorjones flavorjones closed this May 9, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 9, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/dompurify-3.4.0 branch May 9, 2026 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@dixpac @flavorjones