Skip to content

web: bump dompurify from 3.3.3 to 3.4.0 in /web#21632

Merged
BeryJu merged 1 commit intomainfrom
dependabot/npm_and_yarn/web/dompurify-3.4.0
Apr 16, 2026
Merged

web: bump dompurify from 3.3.3 to 3.4.0 in /web#21632
BeryJu merged 1 commit intomainfrom
dependabot/npm_and_yarn/web/dompurify-3.4.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 16, 2026

Bumps dompurify from 3.3.3 to 3.4.0.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

  • Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
  • Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
  • Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
  • Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
  • Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
  • Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
  • Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth
  • Fixed an issue with USE_PROFILES prototype pollution, thanks @​christos-eth
  • Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @​researchatfluidattacks and others
  • Fixed an issue with closing tags leading to possible mXSS, thanks @​frevadiscor
  • Fixed a problem with the type dentition patcher after Node version bump
  • Fixed freezing BS runs by reducing the tested browsers array
  • Bumped several dependencies where possible
  • Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.3.3 to 3.4.0.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.3...3.4.0)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Apr 16, 2026
@dependabot dependabot bot requested a review from a team as a code owner April 16, 2026 03:29
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Apr 16, 2026
@netlify
Copy link
Copy Markdown

netlify bot commented Apr 16, 2026

Deploy Preview for authentik-storybook ready!

Name Link
🔨 Latest commit b5f9f7e
🔍 Latest deploy log https://app.netlify.com/projects/authentik-storybook/deploys/69e057b16919c300081e655d
😎 Deploy Preview https://deploy-preview-21632--authentik-storybook.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify
Copy link
Copy Markdown

netlify bot commented Apr 16, 2026

Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit b5f9f7e
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/69e057b1c69c14000845d370
😎 Deploy Preview https://deploy-preview-21632--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 16, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.25%. Comparing base (00639d9) to head (b5f9f7e).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #21632      +/-   ##
==========================================
- Coverage   92.29%   92.25%   -0.05%     
==========================================
  Files        1032     1032              
  Lines       59789    59789              
  Branches     2537     2537              
==========================================
- Hits        55183    55159      -24     
- Misses       4541     4567      +26     
+ Partials       65       63       -2     
Flag Coverage Δ
conformance 36.97% <ø> (+<0.01%) ⬆️
e2e 42.91% <ø> (+0.02%) ⬆️
integration 33.38% <ø> (-0.52%) ⬇️
rust 60.58% <ø> (+0.07%) ⬆️
unit 91.92% <ø> (+<0.01%) ⬆️
unit-migrate 92.02% <ø> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@BeryJu BeryJu merged commit d2cbd82 into main Apr 16, 2026
109 checks passed
@BeryJu BeryJu deleted the dependabot/npm_and_yarn/web/dompurify-3.4.0 branch April 16, 2026 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant