note Bump dompurify and mermaid

Bumps dompurify to 3.2.4 and updates ancestor dependency mermaid. These dependencies need to be updated together.

Updates dompurify from 3.1.6 to 3.2.4

Release notes

DOMPurify 3.2.4

Fixed a conditional and config dependent mXSS-style bypass reported by @nsysean

Added a new feature to allow specific hook removal, thanks @davecardwell

Added purify.js and purify.min.js to exports, thanks @Aetherinox

Added better logic in case no window object is president, thanks @yehuya

Updated some dependencies called out by dependabot

Updated license files etc to show the correct year

DOMPurify 3.2.3

Fixed two conditional sanitizer bypasses discovered by @parrot409 and @Slonser

Updated the attribute clobbering checks to prevent future bypasses, thanks @parrot409

DOMPurify 3.2.2

Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @yaniv-git

Fixed several minor issues with the type definitions, thanks again @reduckted

Fixed a minor issue with the types reference for trusted types, thanks @reduckted

Fixed a minor problem with the template detection regex on some systems, thanks @svdb99

DOMPurify 3.2.1

Fixed several minor issues with the type definitions, thanks @reduckted @ghiscoding @asamuzaK @MiniDigger

Fixed an issue with non-minified dist files and order of imports, thanks @reduckted

DOMPurify 3.2.0

Added type declarations, thanks @reduckted , @philmayfield, @aloisklink, @ssi02014 and others

Fixed a minor issue with the handling of hooks, thanks @kevin-mizu

DOMPurify 3.1.7

Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @masatokinugawa

Fixed several smaller typos in documentation and test & build files, thanks @christianhg

Added better support for Angular compiler, thanks @jeroen1602

Added several new attributes to HTML and SVG allow-list, thanks @Gigabyte5671 and @Rotzbua

Removed the foreignObject element from the list of HTML entry-points, thanks @masatokinugawa

Bumped several dependencies to be more up to date

Commits

ec29e65 Merge pull request #1062 from cure53/main
1c1b183 chore: Preparing 3.2.4 release
d18ffcb fix: Changed the template literal regex to avoid a config-dependent bypass
0d64d2b Merge pull request #1060 from yehuya/initializeTestImprovements
9ad7933 tests: DOMPurify custom window tests improvements
72760ca Merge pull request #1059 from yehuya/fixMissingWindowElement
bc72d44 Fix tests
363a89d fix: handle undefined Element in DOMPurify initialization
f41b45d Update LICENSE
b25bf26 Update README.md
Additional commits viewable in compare view

Updates mermaid from 11.4.0 to 11.4.1

Release notes

Sourced from mermaid's releases.

[email protected]

Patch Changes

#6059 01b5079 Thanks @knsv! - fix: Kanban diagrams will not render when adding a number as ticket id or assigned for a task

#6038 1388662 Thanks @knsv! - fix: Intersection calculations for tilted cylinder/DAS when using handdrawn look. Some random seeds could cause the calculations to break.

#6079 fe3cffb Thanks @aloisklink! - Bump dompurify to ^3.2.1. This removes the need for @types/dompurify.

Commits

9868f3a Merge pull request #6084 from mermaid-js/changeset-release/master
d8bf155 Version Packages
0b4f852 Merge pull request #6083 from mermaid-js/release/11.4.1
0dff4ca chore: broken link clean up. Enable flowchart elk tests
cc29437 Merge pull request #6081 from mermaid-js/6080-fix
dfaaf36 Merge pull request #6079 from aloisklink/chore/update-to-dompurify-3.2.1
3753831 Added cypress test
c7ae08a #6080: Fix for issue with diamond intersections when using elk-layout
69973ea Merge branch 'develop' into 6080-fix
d3b2c7e Revert "#6080: Fix for issue with diamond intersections when using elk-layout"
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

Note Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Feb 27 '25 10:02 dependabot[bot]

Deploying note with Cloudflare Pages

Latest commit:	`49872bd`
Status:	✅ Deploy successful!
Preview URL:	https://10b24ee6.note-e01.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-mult-ahxj.note-e01.pages.dev

View logs

Feb 27 '25 10:02 cloudflare-workers-and-pages[bot]

@dependabot recreate

Sep 08 '25 08:09 0xcaffebabe

Looks like these dependencies are up-to-date now, so this is no longer needed.

Sep 08 '25 08:09 dependabot[bot]