Bump dompurify from 3.3.3 to 3.4.14 in /assets by dependabot[bot] · Pull Request #1279 · pulibrary/dpul-collections

dependabot · 2026-06-17T22:12:11Z

Bumps dompurify from 3.3.3 to 3.4.14.

Release notes

DOMPurify 3.4.14

Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @AlirezaRouhbakhsh

Fixed a couple of edge cases with mixed document contexts, thanks @fishjojo1

Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @Jaybhade

Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation

Updated the documentation in several spots, README, wiki, etc., thanks @Akokonunes

Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr

Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG

Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG

Bumped several dependencies where possible

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.11

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs

Bumped vulnerable development dependencies to arrive at plain 0 with npm audit

Updated the osv-scanner suppression list as no vulnerable dependencies are left for now

Updated up the linting tool-chain and removed now-redundant lint directives

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.10

Refactored codebase for clarity: extracted the public type declarations into types.ts

Decomposed the three largest sanitizer functions into focused helpers

Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path

Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML

Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode

Reduced CI cost by running the full three-engine browser suite once per PR

Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

Documented the bench and test:happydom scripts in the README

Completed the Attack Classes & Bypass History wiki page

Bumped several dependencies where possible

DOMPurify 3.4.9

Further improved the handling of Trusted Types config options, thanks @offset

Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb

Added more test coverage for IN_PLACE and Trusted Types related usage

Bumped several dependencies where possible

Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

... (truncated)

Commits

4e6fe24 release: 3.4.14 (#1587)
3067f77 release: 3.4.13 (#1562)
a9ca1e5 release: 3.4.12 (#1537)
0cae518 release: 3.4.11 (#1494)
6ee5716 release: 3.4.10 (#1478)
5210247 release: 3.4.9 (#1459)
bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
bb7739e release: 3.4.6 (#1394)
011b0c7 release: 3.4.5 (#1382)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

github-actions · 2026-06-17T22:14:20Z

Container Scanning Status: ❌ Failure

NAME                     INSTALLED                FIXED IN          TYPE  VULNERABILITY   SEVERITY    EPSS         RISK   
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-14456  High        0.6% (46th)  0.5    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-14456  High        0.6% (46th)  0.5    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-14456  High        0.6% (46th)  0.5    
bsdutils                 1:2.41-5                 2.41.5-0+deb13u1  deb   CVE-2026-13595  Medium      0.2% (4th)   < 0.1  
libblkid1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-13595  Medium      0.2% (4th)   < 0.1  
liblastlog2-2            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-13595  Medium      0.2% (4th)   < 0.1  
libmount1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-13595  Medium      0.2% (4th)   < 0.1  
libsmartcols1            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-13595  Medium      0.2% (4th)   < 0.1  
libuuid1                 2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-13595  Medium      0.2% (4th)   < 0.1  
login                    1:4.16.0-2+really2.41-5  2.41.5-0+deb13u1  deb   CVE-2026-13595  Medium      0.2% (4th)   < 0.1  
mount                    2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-13595  Medium      0.2% (4th)   < 0.1  
util-linux               2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-13595  Medium      0.2% (4th)   < 0.1  
bsdutils                 1:2.41-5                 2.41.5-0+deb13u1  deb   CVE-2026-27456  Medium      0.1% (1st)   < 0.1  
libblkid1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-27456  Medium      0.1% (1st)   < 0.1  
liblastlog2-2            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-27456  Medium      0.1% (1st)   < 0.1  
libmount1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-27456  Medium      0.1% (1st)   < 0.1  
libsmartcols1            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-27456  Medium      0.1% (1st)   < 0.1  
libuuid1                 2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-27456  Medium      0.1% (1st)   < 0.1  
login                    1:4.16.0-2+really2.41-5  2.41.5-0+deb13u1  deb   CVE-2026-27456  Medium      0.1% (1st)   < 0.1  
mount                    2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-27456  Medium      0.1% (1st)   < 0.1  
util-linux               2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-27456  Medium      0.1% (1st)   < 0.1  
bsdutils                 1:2.41-5                 2.41.3-1          deb   CVE-2025-14104  Negligible  0.2% (9th)   < 0.1  
libblkid1                2.41-5                   2.41.3-1          deb   CVE-2025-14104  Negligible  0.2% (9th)   < 0.1  
liblastlog2-2            2.41-5                   2.41.3-1          deb   CVE-2025-14104  Negligible  0.2% (9th)   < 0.1  
libmount1                2.41-5                   2.41.3-1          deb   CVE-2025-14104  Negligible  0.2% (9th)   < 0.1  
libsmartcols1            2.41-5                   2.41.3-1          deb   CVE-2025-14104  Negligible  0.2% (9th)   < 0.1  
libuuid1                 2.41-5                   2.41.3-1          deb   CVE-2025-14104  Negligible  0.2% (9th)   < 0.1  
login                    1:4.16.0-2+really2.41-5  2.41.3-1          deb   CVE-2025-14104  Negligible  0.2% (9th)   < 0.1  
mount                    2.41-5                   2.41.3-1          deb   CVE-2025-14104  Negligible  0.2% (9th)   < 0.1  
util-linux               2.41-5                   2.41.3-1          deb   CVE-2025-14104  Negligible  0.2% (9th)   < 0.1  
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-14457  High        N/A          N/A    
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-18798  High        N/A          N/A    
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-54874  High        N/A          N/A    
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63072  High        N/A          N/A    
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63075  High        N/A          N/A    
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63076  High        N/A          N/A    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-14457  High        N/A          N/A    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-18798  High        N/A          N/A    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-54874  High        N/A          N/A    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63072  High        N/A          N/A    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63075  High        N/A          N/A    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63076  High        N/A          N/A    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-14457  High        N/A          N/A    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-18798  High        N/A          N/A    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-54874  High        N/A          N/A    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63072  High        N/A          N/A    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63075  High        N/A          N/A    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63076  High        N/A          N/A    
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63074  Medium      N/A          N/A    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63074  Medium      N/A          N/A    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63074  Medium      N/A          N/A    
bsdutils                 1:2.41-5                 2.41.5-0+deb13u1  deb   CVE-2026-53612  Unknown     N/A          N/A    
bsdutils                 1:2.41-5                 2.41.5-0+deb13u1  deb   CVE-2026-53613  Unknown     N/A          N/A    
bsdutils                 1:2.41-5                 2.41.5-0+deb13u1  deb   CVE-2026-53614  Unknown     N/A          N/A    
bsdutils                 1:2.41-5                 2.41.5-0+deb13u1  deb   CVE-2026-53615  Unknown     N/A          N/A    
libblkid1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53612  Unknown     N/A          N/A    
libblkid1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53613  Unknown     N/A          N/A    
libblkid1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53614  Unknown     N/A          N/A    
libblkid1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53615  Unknown     N/A          N/A    
liblastlog2-2            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53612  Unknown     N/A          N/A    
liblastlog2-2            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53613  Unknown     N/A          N/A    
liblastlog2-2            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53614  Unknown     N/A          N/A    
liblastlog2-2            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53615  Unknown     N/A          N/A    
libmount1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53612  Unknown     N/A          N/A    
libmount1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53613  Unknown     N/A          N/A    
libmount1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53614  Unknown     N/A          N/A    
libmount1                2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53615  Unknown     N/A          N/A    
libsmartcols1            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53612  Unknown     N/A          N/A    
libsmartcols1            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53613  Unknown     N/A          N/A    
libsmartcols1            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53614  Unknown     N/A          N/A    
libsmartcols1            2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53615  Unknown     N/A          N/A    
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63073  Unknown     N/A          N/A    
libssl3t64               3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-75803  Unknown     N/A          N/A    
libuuid1                 2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53612  Unknown     N/A          N/A    
libuuid1                 2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53613  Unknown     N/A          N/A    
libuuid1                 2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53614  Unknown     N/A          N/A    
libuuid1                 2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53615  Unknown     N/A          N/A    
login                    1:4.16.0-2+really2.41-5  2.41.5-0+deb13u1  deb   CVE-2026-53612  Unknown     N/A          N/A    
login                    1:4.16.0-2+really2.41-5  2.41.5-0+deb13u1  deb   CVE-2026-53613  Unknown     N/A          N/A    
login                    1:4.16.0-2+really2.41-5  2.41.5-0+deb13u1  deb   CVE-2026-53614  Unknown     N/A          N/A    
login                    1:4.16.0-2+really2.41-5  2.41.5-0+deb13u1  deb   CVE-2026-53615  Unknown     N/A          N/A    
mount                    2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53612  Unknown     N/A          N/A    
mount                    2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53613  Unknown     N/A          N/A    
mount                    2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53614  Unknown     N/A          N/A    
mount                    2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53615  Unknown     N/A          N/A    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63073  Unknown     N/A          N/A    
openssl                  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-75803  Unknown     N/A          N/A    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-63073  Unknown     N/A          N/A    
openssl-provider-legacy  3.5.6-1~deb13u2          3.5.7-1~deb13u2   deb   CVE-2026-75803  Unknown     N/A          N/A    
util-linux               2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53612  Unknown     N/A          N/A    
util-linux               2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53613  Unknown     N/A          N/A    
util-linux               2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53614  Unknown     N/A          N/A    
util-linux               2.41-5                   2.41.5-0+deb13u1  deb   CVE-2026-53615  Unknown     N/A          N/A

tpendragon · 2026-08-26T23:09:10Z

@dependabot rebase

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.3.3 to 3.4.14. - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.14) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies javascript labels Jun 17, 2026

dependabot Bot mentioned this pull request Jun 17, 2026

Bump dompurify from 3.3.3 to 3.4.10 in /assets #1272

Closed

dependabot Bot changed the title ~~Bump dompurify from 3.3.3 to 3.4.11 in /assets~~ Bump dompurify from 3.3.3 to 3.4.14 in /assets Aug 26, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/assets/dompurify-3.4.11 branch from c85e21f to f5e57de Compare August 26, 2026 23:10

Navigation Menu

Uh oh!

Bump dompurify from 3.3.3 to 3.4.14 in /assets - #1279

Bump dompurify from 3.3.3 to 3.4.14 in /assets#1279
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/assets/dompurify-3.4.11

dependabot Bot commented on behalf of github Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

tpendragon commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DOMPurify 3.4.14

DOMPurify 3.4.13

DOMPurify 3.4.12

DOMPurify 3.4.11

DOMPurify 3.4.10

DOMPurify 3.4.9

DOMPurify 3.4.8

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Container Scanning Status: ❌ Failure

Uh oh!

tpendragon commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading