📦 Update dependency dompurify to v3.1.3 [SECURITY] #40150
+8
−8
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.0.2
->3.1.3
See all other Renovate PRs on the Dependency Dashboard
How to resolve breaking changes
This PR may introduce breaking changes that require manual intervention. In such cases, you will need to check out this branch, fix the cause of the breakage, and commit the fix to ensure a green CI build. To check out and update this PR, follow the steps below:
GitHub Vulnerability Alerts
CVE-2024-45801
It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.
This renders dompurify unable to avoid XSS attack.
Fixed by cure53/DOMPurify@1e52026 (3.x branch) and cure53/DOMPurify@26e1d69 (2.x branch).
CVE-2024-47875
DOMpurify was vulnerable to nesting-based mXSS
fixed by 0ef5e537 (2.x) and
merge 943
Backporter should be aware of GHSA-mmhx-hmjr-r674 (CVE-2024-45801) when cherry-picking
POC is avaible under test
Release Notes
cure53/DOMPurify (dompurify)
v3.1.3
: DOMPurify 3.1.3Compare Source
nodeType
property, thanks @ssi02014v3.1.2
: DOMPurify 3.1.2Compare Source
v3.1.1
: DOMPurify 3.1.1Compare Source
Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.
v3.1.0
: DOMPurify 3.1.0Compare Source
SAFE_FOR_XML
to enable better control over comment scrubbingv3.0.11
: DOMPurify 3.0.11Compare Source
v3.0.10
: DOMPurify 3.0.10Compare Source
v3.0.9
: DOMPurify 3.0.9Compare Source
hasOwnProperty
logic, thanks @ssi02014console.warn
making HappyDom happier, thanks @HugoPoiv3.0.8
: DOMPurify 3.0.8Compare Source
v3.0.7
: DOMPurify 3.0.7Compare Source
v3.0.6
: DOMPurify 3.0.6Compare Source
v3.0.5
: DOMPurify 3.0.5Compare Source
v3.0.4
: DOMPurify 3.0.4Compare Source
shadowrootmod
which should beshadowrootmode
, thanks @masatokinugawav3.0.3
: DOMPurify 3.0.3Compare Source
TRUSTED_TYPES_POLICY
configuration option, thanks @dejangfeDropShadow
to the SVG filter allow-list, thanks @SelfMadeSystemConfiguration
📅 Schedule: Branch creation - "" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.