Skip to content

chore(deps): bump dompurify from 3.4.11 to 3.4.13 in /web - #6735

Merged
seefs001 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/web/dompurify-3.4.13
Aug 14, 2026
Merged

chore(deps): bump dompurify from 3.4.11 to 3.4.13 in /web#6735
seefs001 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/web/dompurify-3.4.13

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 9, 2026

Copy link
Copy Markdown
Contributor

Bumps dompurify from 3.4.11 to 3.4.13.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.13.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 9, 2026
@seefs001
seefs001 merged commit f250f3b into main Aug 14, 2026
2 of 3 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/web/dompurify-3.4.13 branch August 14, 2026 08:58
xq666xq pushed a commit to xq666xq/new-api that referenced this pull request Aug 14, 2026
上游 f250f3b (QuantumNous#6735) 仅升级了 web/package.json 的 dompurify 3.4.11 -> 3.4.13,
未同步 web/bun.lock,导致 lockfile 与 package.json 不一致。

Co-Authored-By: Claude <noreply@anthropic.com>
kimberxu pushed a commit to kimberxu/new-api that referenced this pull request Aug 14, 2026
0401lucky pushed a commit to 0401lucky/new-api that referenced this pull request Aug 16, 2026
…s#6735)

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.13.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
junjundesk pushed a commit to junjundesk/new-api that referenced this pull request Aug 17, 2026
…s#6735)

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.13.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
330079598 pushed a commit to 330079598/new-api that referenced this pull request Aug 19, 2026
…s#6735)

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.13.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
biubiubiu125 pushed a commit to biubiubiu125/newapi that referenced this pull request Aug 29, 2026
…s#6735)

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.13.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant