chore(deps): bump dompurify from 3.2.6 to 3.3.2 in /docs #3020

Merged

dependabot[bot] merged 1 commit from refs/pull/3020/head into staging

2026-03-26 00:35:19 +00:00

dependabot[bot] commented

2026-03-07 17:02:29 +00:00

(Migrated from github.com)

Owner

Imported from GitHub pull request.

Original GitHub pull request: #3001
Original author: @dependabot[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/3001
Original created: 2026-03-07T17:02:29Z
Original updated: 2026-03-26T00:35:21Z
Original head: carverauto/serviceradar:dependabot/npm_and_yarn/docs/dompurify-3.3.2
Original base: staging
Original merged: 2026-03-26T00:35:19Z by @mfreeman451

Bumps dompurify from 3.2.6 to 3.3.2.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.2

Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters

Fixed a prototype pollution issue when working with custom elements, thanks @christos-eth

Fixed a lenient config parsing in _isValidAttribute, thanks @christos-eth

Bumped and removed several dependencies, thanks @Rotzbua

Fixed the test suite after bumping dependencies, thanks @Rotzbua

DOMPurify 3.3.1

Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @MariusRumpf

Updated the ESM import syntax to be more correct, thanks @binhpv

DOMPurify 3.3.0

Added the SVG mask-type attribute to default allow-list, thanks @prasadrajandran

Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @nelstrom

Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @Wim-Valgaeren

DOMPurify 3.2.7

Added new attributes and elements to default allow-list, thanks @elrion018

Added tagName parameter to custom element attributeNameCheck, thanks @nelstrom

Added better check for animated href attributes, thanks @llamakko

Updated and improved the bundled types, thanks @ssi02014

Updated several tests to better align with new browser encoding behaviors

Improved the handling of potentially risky content inside CDATA elements, thanks @securityMB & @terjanq

Improved the regular expression for raw-text elements to cover textareas, thanks @securityMB & @terjanq

Commits

5e56114 Getting 3.x branch ready for 3.3.2 release (#1208)
e8c95f4 fix: Fixed the broken package-lock.json
9636037 Update package-lock.json
5cad4ce Getting 3.x branch ready for 3.3.2 releas (#1205)
6fc446a Merge pull request #1175 from cure53/main
3b3bf91 Merge branch 'main' of github.com:cure53/DOMPurify
9863f41 chore: Preparing 3.3.1 release
b4e0295 chore: Preparing 3.3.0 release
077746b build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1170)
4de68bb build(deps): bump actions/checkout from 5 to 6 (#1171)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Imported from GitHub pull request. Original GitHub pull request: #3001 Original author: @dependabot[bot] Original URL: https://github.com/carverauto/serviceradar/pull/3001 Original created: 2026-03-07T17:02:29Z Original updated: 2026-03-26T00:35:21Z Original head: carverauto/serviceradar:dependabot/npm_and_yarn/docs/dompurify-3.3.2 Original base: staging Original merged: 2026-03-26T00:35:19Z by @mfreeman451 --- Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.2.6 to 3.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.3.2</h2> <ul> <li>Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters</li> <li>Fixed a prototype pollution issue when working with custom elements, thanks <a href="https://github.com/christos-eth"><code>@christos-eth</code></a></li> <li>Fixed a lenient config parsing in <code>_isValidAttribute</code>, thanks <a href="https://github.com/christos-eth"><code>@christos-eth</code></a></li> <li>Bumped and removed several dependencies, thanks <a href="https://github.com/Rotzbua"><code>@Rotzbua</code></a></li> <li>Fixed the test suite after bumping dependencies, thanks <a href="https://github.com/Rotzbua"><code>@Rotzbua</code></a></li> </ul> <h2>DOMPurify 3.3.1</h2> <ul> <li>Updated <code>ADD_FORBID_CONTENTS</code> setting to extend default list, thanks <a href="https://github.com/MariusRumpf"><code>@MariusRumpf</code></a></li> <li>Updated the ESM import syntax to be more correct, thanks <a href="https://github.com/binhpv"><code>@binhpv</code></a></li> </ul> <h2>DOMPurify 3.3.0</h2> <ul> <li>Added the SVG <code>mask-type</code> attribute to default allow-list, thanks <a href="https://github.com/prasadrajandran"><code>@prasadrajandran</code></a></li> <li>Added support for <code>ADD_ATTR</code> and <code>ADD_TAGS</code> to accept functions, thanks <a href="https://github.com/nelstrom"><code>@nelstrom</code></a></li> <li>Fixed an issue with the <code>slot</code> element being in both SVG and HTML allow-list, thanks <a href="https://github.com/Wim-Valgaeren"><code>@Wim-Valgaeren</code></a></li> </ul> <h2>DOMPurify 3.2.7</h2> <ul> <li>Added new attributes and elements to default allow-list, thanks <a href="https://github.com/elrion018"><code>@elrion018</code></a></li> <li>Added <code>tagName</code> parameter to custom element <code>attributeNameCheck</code>, thanks <a href="https://github.com/nelstrom"><code>@nelstrom</code></a></li> <li>Added better check for animated <code>href</code> attributes, thanks <a href="https://github.com/llamakko"><code>@llamakko</code></a></li> <li>Updated and improved the bundled types, thanks <a href="https://github.com/ssi02014"><code>@ssi02014</code></a></li> <li>Updated several tests to better align with new browser encoding behaviors</li> <li>Improved the handling of potentially risky content inside CDATA elements, thanks <a href="https://github.com/securityMB"><code>@securityMB</code></a> & <a href="https://github.com/terjanq"><code>@terjanq</code></a></li> <li>Improved the regular expression for raw-text elements to cover textareas, thanks <a href="https://github.com/securityMB"><code>@securityMB</code></a> & <a href="https://github.com/terjanq"><code>@terjanq</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/5e56114cb24079ce52dbc51f76e494b77afa5153"><code>5e56114</code></a> Getting 3.x branch ready for 3.3.2 release (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1208">#1208</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/e8c95f4a27aa8b041f92b59ab7685a94f7be6208"><code>e8c95f4</code></a> fix: Fixed the broken package-lock.json</li> <li><a href="https://github.com/cure53/DOMPurify/commit/9636037c145b769dad0b52da8313301cbf867f46"><code>9636037</code></a> Update package-lock.json</li> <li><a href="https://github.com/cure53/DOMPurify/commit/5cad4cecf2e647ac66eed25bc02a2415f00dbc8b"><code>5cad4ce</code></a> Getting 3.x branch ready for 3.3.2 releas (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1205">#1205</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/6fc446a589ab3d1d72ae2a5b71167ba38dbd3096"><code>6fc446a</code></a> Merge pull request <a href="https://redirect.github.com/cure53/DOMPurify/issues/1175">#1175</a> from cure53/main</li> <li><a href="https://github.com/cure53/DOMPurify/commit/3b3bf917d2b39460de6d130acebdc9243cf3e6ae"><code>3b3bf91</code></a> Merge branch 'main' of github.com:cure53/DOMPurify</li> <li><a href="https://github.com/cure53/DOMPurify/commit/9863f4195bae6048de9eb2802219218c6904066c"><code>9863f41</code></a> chore: Preparing 3.3.1 release</li> <li><a href="https://github.com/cure53/DOMPurify/commit/b4e02954dc4172c3944a755f3e99fbb76be64f7b"><code>b4e0295</code></a> chore: Preparing 3.3.0 release</li> <li><a href="https://github.com/cure53/DOMPurify/commit/077746bb2cfb77836dfb628dca7ffc7ced8a5356"><code>077746b</code></a> build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1170">#1170</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/4de68bba9aba43dc3bba9348df603b64fc06d591"><code>4de68bb</code></a> build(deps): bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1171">#1171</a>)</li> <li>Additional commits viewable in <a href="https://github.com/cure53/DOMPurify/compare/3.2.6...3.3.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.2.6&new-version=3.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/carverauto/serviceradar/network/alerts). </details>