Bump dompurify and monaco-editor in /src-editor

Open dependabot[bot] opened this issue 1 month ago • 0 comments

Bumps dompurify to 3.2.7 and updates ancestor dependency monaco-editor. These dependencies need to be updated together.

Updates dompurify from 3.1.7 to 3.2.7

Release notes

DOMPurify 3.2.7

Added new attributes and elements to default allow-list, thanks @elrion018

Added tagName parameter to custom element attributeNameCheck, thanks @nelstrom

Added better check for animated href attributes, thanks @llamakko

Updated and improved the bundled types, thanks @ssi02014

Updated several tests to better align with new browser encoding behaviors

Improved the handling of potentially risky content inside CDATA elements, thanks @securityMB & @terjanq

Improved the regular expression for raw-text elements to cover textareas, thanks @securityMB & @terjanq

DOMPurify 3.2.6

Fixed several typos and removed clutter from our documentation, thanks @Rotzbua

Added matrix: as an allowed URI scheme, thanks @kleinesfilmroellchen

Added better config hardening against prototype pollution, thanks @EffectRenan

Added better handling of attribute removal, thanks @michalnieruchalski-tiugo

Added better configuration for aggressive mXSS scrubbing behavior, thanks @BryanValverdeU

Removed the script that caused the fake entry CVE-2025-48050

DOMPurify 3.2.5

Added a check to the mXSS detection regex to be more strict, thanks @masatokinugawa

Added ESM type imports in source, removes patch function, thanks @donmccurdy

Added script to verify various TypeScript configurations, thanks @reduckted

Added more modern browsers to the Karma launchers list

Added Node 23.x to tested runtimes, removed Node 17.x

Fixed the generation of source maps, thanks @reduckted

Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @hhk-png

Fixed a few typos in the README file

DOMPurify 3.2.4

Fixed a conditional and config dependent mXSS-style bypass reported by @nsysean

Added a new feature to allow specific hook removal, thanks @davecardwell

Added purify.js and purify.min.js to exports, thanks @Aetherinox

Added better logic in case no window object is president, thanks @yehuya

Updated some dependencies called out by dependabot

Updated license files etc to show the correct year

DOMPurify 3.2.3

Fixed two conditional sanitizer bypasses discovered by @parrot409 and @Slonser

Updated the attribute clobbering checks to prevent future bypasses, thanks @parrot409

DOMPurify 3.2.2

Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @yaniv-git

Fixed several minor issues with the type definitions, thanks again @reduckted

Fixed a minor issue with the types reference for trusted types, thanks @reduckted

Fixed a minor problem with the template detection regex on some systems, thanks @svdb99

DOMPurify 3.2.1

Fixed several minor issues with the type definitions, thanks @reduckted @ghiscoding @asamuzaK @MiniDigger

Fixed an issue with non-minified dist files and order of imports, thanks @reduckted

... (truncated)

Commits

eaa0bdb Merge pull request #1144 from cure53/main
f712593 fix: removed a possibly dossy regex
eb9b3b6 Merge branch 'main' of github.com:cure53/DOMPurify
ce006f7 chore: Preparing 3.2.7 release
ef0e0cb chore: Preparing 3.2.6 release
2f09cd3 Update README.md
6a795bc Merge pull request #1142 from cure53/dependabot/github_actions/actions/setup-...
2458bbd build(deps): bump actions/setup-node from 4 to 5
e43d3f3 Merge pull request #1136 from cure53/dependabot/github_actions/actions/checko...
6f5be37 build(deps): bump actions/checkout from 4 to 5
Additional commits viewable in compare view

Updates monaco-editor from 0.54.0 to 0.55.1

Release notes

Sourced from monaco-editor's releases.

v0.55.1

Changes:

#5121: Fixes missing language exports

#5122: v0.55.1

This list of changes was auto generated.

v0.55.0

Changes:

#5120: Fixes npx playwright install --with-deps

#5118: Fixes microsoft/monaco-editor#5113

#5117: v0.55.0

#5116: Install playwright dependencies in monaco-editor-core job

#5105: Fixes website

#5104: fixes website & adds editor.api.d.ts

#5102: Fixes typedoc & updates pipelines to test website

#5100: Updates website dependencies

#5071: Bump vite from 5.4.20 to 5.4.21 in /samples/browser-esm-vite-react

#4961: Bump on-headers and compression in /samples

#5040: Bump @babel/runtime from 7.18.9 to 7.28.4 in /website

#5095: Bump vite from 7.1.9 to 7.1.11 in /samples/browser-esm-vite

#5097: Cleans up build scripts

#5098: Dont build the editor when building the website

#5099: Run tests

#5094: Adds vite esm example

#5093: Adds playground support for esmUrl

#5092: Updates changelog

#5090: Adds localization section to readme

#5089: Adds missing NLS files

#5088: Dont use .js for typescript imports, as rollup adds them to the output

#5070: Bump vite from 7.1.5 to 7.1.11

#5069: Bump playwright and @playwright/test

#5058: Add monaco-editor-core dependencies to monaco-editor after updating monaco-editor-core.

#5053: Bump loader-utils from 2.0.2 to 2.0.4 in /website

#5055: Bump postcss and css-loader in /website

#5054: Bump json5 from 2.2.1 to 2.2.3 in /website

#4973: Fix Kotlin number literals

#4991: Bump vite from 2.9.17 to 5.4.20 in /samples/browser-esm-vite-react

#5039: Bump webpack from 5.90.1 to 5.102.1 in /website

#5037: Bump ws in /website

#5010: [Bug] Multiple issues with how monaco-editor is published

#5051: Fixes #5010

... (truncated)

Changelog

Sourced from monaco-editor's changelog.

[0.55.1]

Fixes missing language exports (monaco.json/typescript/...) due to wrong "types" path - #5123

[0.55.0]

Breaking Changes

Moves nested namespaces (languages.css, languages.html, languages.json, languages.typescript) to top level namespaces (css, html, json, typescript) to simplify the build process and align with typescript recommendations.

New Features

Adds native LSP support (see new lsp namespace).

Bug Fixes

Updates dompurify to 3.2.7

Commits

516f350 Fixes missing language exports (#5121)
9221aa0 v0.55.1 (#5122)
d678c1d Merge pull request #5120 from microsoft/hediet/enormous-herring
f047a08 Fixes npx playwright install --with-deps
220c1ca Fixes microsoft/monaco-editor#5113 (#5118)
1b175c7 v0.55.0 (#5117)
574b846 Install playwright dependencies in monaco-editor-core job (#5116)
5486e82 update (#5105)
e70b661 fixes website & adds editor.api.d.ts (#5104)
36efbe0 Fixes typedoc & updates pipelines to test website (#5102)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

Dec 13 '25 07:12 dependabot[bot]