chore(deps): update dependency dompurify to v3.4.3 by thomhurst · Pull Request #5913 · thomhurst/TUnit

thomhurst · 2026-05-13T12:17:25Z

This PR contains the following updates:

Package	Type	Update	Change
dompurify	resolutions	patch	`3.4.2` → `3.4.3`

Release Notes

cure53/DOMPurify (dompurify)

`v3.4.3`: DOMPurify 3.4.3

Compare Source

Fixed an issue with handling of nested Shadow DOM trees, thanks @fishjojo1
Fixed the template regexes to be more robust against ReDoS attacks, thanks @aleung27
Updated the node iteration code to catch more Shadow DOM related issues
Updated Playwright and added Node 26 to test matrix
Updated existing workflows, fuzzer, release signing, etc., added more tests
Bumped several dependencies where possible

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

codacy-production · 2026-05-13T12:18:18Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

claude

Code Review: dompurify 3.4.2 → 3.4.3

This is a Renovate-generated patch bump for DOMPurify, a security-sensitive XSS sanitization library used in the docs site.

What changed

docs/package.json — version pin updated
docs/yarn.lock — integrity hash updated to match the new release

Both changes are consistent and correct; the lock file hash matches the published npm artifact.

Why this matters

This is not a cosmetic bump. The 3.4.3 release includes two security-relevant fixes:

ReDoS hardening — template regexes were made more robust against Regular Expression Denial of Service attacks.
Shadow DOM fixes — nested Shadow DOM tree handling was corrected, preventing potential sanitization bypasses in environments that use Shadow DOM.

Approving patch updates to a sanitization library promptly is the right call — the risk of not updating outweighs any regression risk from a patch version.

Assessment

No concerns. The diff is minimal, mechanically correct, and the underlying library changes are purely defensive security improvements. Auto-merge is appropriate here.

claude · 2026-05-13T23:31:02Z

Code Review Follow-up

No changes since the previous review — still on commit 65246b0. The prior approval stands.

Summary: This is a clean, minimal patch bump of DOMPurify (3.4.2 → 3.4.3) with two security-relevant fixes (ReDoS hardening + Shadow DOM sanitization). The package.json version pin and yarn.lock integrity hash are consistent with the published npm artifact. No concerns; auto-merge is appropriate.

claude · 2026-05-14T01:46:48Z

Re-review: dompurify 3.4.2 → 3.4.3

Re-checked against the prior approval — no changes to this PR since the previous review.

The diff remains a minimal, correct patch bump:

docs/package.json: version pin updated from 3.4.2 → 3.4.3
docs/yarn.lock: resolved URL and integrity hash both updated consistently

Previous assessment stands: This is a security-positive update (ReDoS hardening + Shadow DOM sanitization fixes in DOMPurify). Auto-merge is appropriate.

claude

Re-review: dompurify 3.4.2 → 3.4.3

No changes since the previous review (2026-05-13). Assessment stands:

Both and are consistent with each other
The 3.4.3 release contains security-relevant fixes (ReDoS hardening, Shadow DOM sanitization bypasses) — prompt uptake is correct
Diff is minimal and mechanically correct

No issues found. Auto-merge remains appropriate.

claude

Re-review: dompurify 3.4.2 to 3.4.3. No changes since the previous review on 2026-05-13. Assessment stands: both package.json and yarn.lock are consistent, and the 3.4.3 release contains security-relevant fixes (ReDoS hardening, Shadow DOM sanitization bypasses). No issues found. Auto-merge remains appropriate.

Updated [TUnit.Core](https://github.com/thomhurst/TUnit) from 1.44.0 to 1.45.8. <details> <summary>Release notes</summary> _Sourced from [TUnit.Core's releases](https://github.com/thomhurst/TUnit/releases)._ ## 1.45.8  ## What's Changed ### Other Changes * fix(aspire): route CreateHttpClient through IHttpClientFactory by @thomhurst in thomhurst/TUnit#5957 ### Dependencies * chore(deps): update tunit to 1.45.0 by @thomhurst in thomhurst/TUnit#5949 * chore(deps): update dependency dompurify to v3.4.5 by @thomhurst in thomhurst/TUnit#5951 * chore(deps): update dependency microsoft.testing.extensions.codecoverage to 18.7.0 by @thomhurst in thomhurst/TUnit#5953 * chore(deps): update dependency coverlet.collector to 10.0.1 by @thomhurst in thomhurst/TUnit#5952 * chore(deps): update dependency polyfill to 10.6.0 by @thomhurst in thomhurst/TUnit#5955 * chore(deps): update dependency polyfill to 10.6.0 by @thomhurst in thomhurst/TUnit#5954 **Full Changelog**: thomhurst/TUnit@v1.45.0...v1.45.8 ## 1.45.0  ## What's Changed ### Other Changes * fix(generator): place CallerArgumentExpression before params in [GenerateAssertion] emit by @JohnVerheij in thomhurst/TUnit#5940 * fix(sourcegen): drop covariant TActual when [GenerateAssertion] method has its own type parameters by @JohnVerheij in thomhurst/TUnit#5935 * feat(assertions): add CancellationToken overload to WaitsFor and Eventually by @JohnVerheij in thomhurst/TUnit#5938 * fix(html-report): extract categories using MTP Key=name convention by @thomhurst in thomhurst/TUnit#5946 * feat(html-report): rewrite as split-pane design template by @thomhurst in thomhurst/TUnit#5947 ### Dependencies * chore(deps): update microsoft.testing to 2.2.3 by @thomhurst in thomhurst/TUnit#5927 * chore(deps): update mstest to 4.2.3 by @thomhurst in thomhurst/TUnit#5928 * chore(deps): update tunit to 1.44.39 by @thomhurst in thomhurst/TUnit#5929 * chore(deps): update aspire to 13.3.3 by @thomhurst in thomhurst/TUnit#5933 * chore(deps): update dependency dompurify to v3.4.4 by @thomhurst in thomhurst/TUnit#5944 * chore(deps): update dependency qs to v6.15.2 by @thomhurst in thomhurst/TUnit#5941 **Full Changelog**: thomhurst/TUnit@v1.44.39...v1.45.0 ## 1.44.39  ## What's Changed ### Other Changes * fix(tests): retry trx read to dodge MTP post-exit flush race on Windows by @thomhurst in thomhurst/TUnit#5888 * fix(pipeline): timeout + retry InstallPlaywrightModule so a hung download fails fast by @thomhurst in thomhurst/TUnit#5889 * fix(otel): require two consecutive idle windows in DrainAsync to catch in-transit POSTs by @thomhurst in thomhurst/TUnit#5890 * test(assertions): drop flaky wall-clock upper bound on WaitsFor timeout test by @thomhurst in thomhurst/TUnit#5886 * fix(sourcegen): drop spurious ')' in MethodAssertionGenerator Task<bool> emit by @JohnVerheij in thomhurst/TUnit#5920 * fix(sourcegen): merge generic parameter lists in [AssertionExtension] emit by @JohnVerheij in thomhurst/TUnit#5921 * fix(aspnetcore): scope correlation processor per-factory to stop cross-factory tag leak by @thomhurst in thomhurst/TUnit#5891 * Changed FSharp.Core version to 10.1.300 by @licon4812 in thomhurst/TUnit#5909 * feat(mocks): add Mock.HttpClientFactory() helper by @thomhurst in thomhurst/TUnit#5894 * Harden WaitsFor timeout test by @thomhurst in thomhurst/TUnit#5926 * fix(sourcegen): emit `default` literal for value-type assertion parameters by @JohnVerheij in thomhurst/TUnit#5919 ### Dependencies * chore(deps): update dependency nunit to 4.6.0 by @thomhurst in thomhurst/TUnit#5826 * chore(deps): update tunit to 1.44.0 by @thomhurst in thomhurst/TUnit#5882 * chore(deps): update dependency mockolate to 3.2.0 by @thomhurst in thomhurst/TUnit#5892 * chore(deps): update dependency yaml to v2.9.0 by @thomhurst in thomhurst/TUnit#5887 * chore(deps): update dependency nuget.protocol to 7.6.0 by @thomhurst in thomhurst/TUnit#5897 * chore(deps): update dependency microsoft.entityframeworkcore to 10.0.8 by @thomhurst in thomhurst/TUnit#5898 * chore(deps): update dependency microsoft.templateengine.authoring.cli to v10.0.300 by @thomhurst in thomhurst/TUnit#5899 * chore(deps): update microsoft.extensions by @thomhurst in thomhurst/TUnit#5905 * chore(deps): update microsoft.aspnetcore to 10.0.8 by @thomhurst in thomhurst/TUnit#5904 * chore(deps): update dependency microsoft.templateengine.authoring.templateverifier to 10.0.300 by @thomhurst in thomhurst/TUnit#5902 * chore(deps): update aspire to 13.3.1 by @thomhurst in thomhurst/TUnit#5900 * chore(deps): update dependency system.commandline to 2.0.8 by @thomhurst in thomhurst/TUnit#5903 * chore(deps): update dependency azure.storage.blobs to 12.28.0 by @thomhurst in thomhurst/TUnit#5910 * chore(deps): update dependency dotnet-sdk to v10.0.300 by @thomhurst in thomhurst/TUnit#5901 * chore(deps): update dependency stackexchange.redis to 2.13.1 by @thomhurst in thomhurst/TUnit#5906 * chore(deps): update aspire to 13.3.2 by @thomhurst in thomhurst/TUnit#5924 * chore(deps): bump mermaid from 11.12.2 to 11.15.0 in /docs by @dependabot[bot] in thomhurst/TUnit#5893 * chore(deps): update dependency streamjsonrpc to 2.24.92 by @thomhurst in thomhurst/TUnit#5915 * chore(deps): update dependency dompurify to v3.4.3 by @thomhurst in thomhurst/TUnit#5913 * chore(deps): update microsoft.build to 18.6.3 by @thomhurst in thomhurst/TUnit#5914 **Full Changelog**: thomhurst/TUnit@v1.44.0...v1.44.39 Commits viewable in [compare view](thomhurst/TUnit@v1.44.0...v1.45.8). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=TUnit.Core&package-manager=nuget&previous-version=1.44.0&new-version=1.45.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

thomhurst added dependencies Pull requests that update a dependency file PATCH renovate-bot labels May 13, 2026

thomhurst enabled auto-merge (squash) May 13, 2026 12:17

thomhurst had a problem deploying to Pull Requests May 13, 2026 12:17 — with GitHub Actions Failure

claude Bot approved these changes May 13, 2026

View reviewed changes

thomhurst force-pushed the renovate/dompurify-3.x branch from 4ebd36f to 65246b0 Compare May 13, 2026 23:30

thomhurst temporarily deployed to Pull Requests May 13, 2026 23:30 — with GitHub Actions Inactive

thomhurst had a problem deploying to Pull Requests May 13, 2026 23:30 — with GitHub Actions Failure

thomhurst force-pushed the renovate/dompurify-3.x branch from 65246b0 to 5952c73 Compare May 14, 2026 01:45

thomhurst had a problem deploying to Pull Requests May 14, 2026 01:45 — with GitHub Actions Failure

thomhurst temporarily deployed to Pull Requests May 14, 2026 01:45 — with GitHub Actions Inactive

thomhurst force-pushed the renovate/dompurify-3.x branch from 5952c73 to 18a3626 Compare May 14, 2026 04:49

thomhurst had a problem deploying to Pull Requests May 14, 2026 04:49 — with GitHub Actions Failure

thomhurst temporarily deployed to Pull Requests May 14, 2026 04:49 — with GitHub Actions Inactive

thomhurst had a problem deploying to Pull Requests May 14, 2026 04:49 — with GitHub Actions Failure

claude Bot approved these changes May 14, 2026

View reviewed changes

chore(deps): update dependency dompurify to v3.4.3

3050320

thomhurst force-pushed the renovate/dompurify-3.x branch from 18a3626 to 3050320 Compare May 14, 2026 09:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency dompurify to v3.4.3#5913

chore(deps): update dependency dompurify to v3.4.3#5913
thomhurst merged 1 commit into
mainfrom
renovate/dompurify-3.x

thomhurst commented May 13, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented May 13, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

claude Bot commented May 13, 2026

Uh oh!

claude Bot commented May 14, 2026

Uh oh!

claude Bot left a comment

Uh oh!

claude Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

thomhurst commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.4.3: DOMPurify 3.4.3

Configuration

Uh oh!

codacy-production Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Code Review: dompurify 3.4.2 → 3.4.3

What changed

Why this matters

Assessment

Uh oh!

claude Bot commented May 13, 2026

Code Review Follow-up

Uh oh!

claude Bot commented May 14, 2026

Re-review: dompurify 3.4.2 → 3.4.3

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Re-review: dompurify 3.4.2 → 3.4.3

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

thomhurst commented May 13, 2026 •

edited

Loading

`v3.4.3`: DOMPurify 3.4.3

codacy-production Bot commented May 13, 2026 •

edited

Loading