From de4c8378855b6c77da930e79ae0b4ebf4e78899c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 21:54:32 -0700
Subject: [PATCH] chore(deps): bump dompurify from 3.2.4 to 3.3.2 (#13738)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.2.4 to
3.3.2.
Release notes
Sourced from dompurify's
releases.
DOMPurify 3.3.2
- Fixed a possible bypass caused by jsdom's faulty raw-text tag
parsing, thanks multiple reporters
- Fixed a prototype pollution issue when working with custom elements,
thanks
@christos-eth
- Fixed a lenient config parsing in
_isValidAttribute,
thanks @christos-eth
- Bumped and removed several dependencies, thanks
@Rotzbua
- Fixed the test suite after bumping dependencies, thanks
@Rotzbua
DOMPurify 3.3.1
- Updated
ADD_FORBID_CONTENTS setting to extend default
list, thanks @MariusRumpf
- Updated the ESM import syntax to be more correct, thanks
@binhpv
DOMPurify 3.3.0
- Added the SVG
mask-type attribute to default
allow-list, thanks @prasadrajandran
- Added support for
ADD_ATTR and ADD_TAGS to
accept functions, thanks @nelstrom
- Fixed an issue with the
slot element being in both SVG
and HTML allow-list, thanks @Wim-Valgaeren
DOMPurify 3.2.7
- Added new attributes and elements to default allow-list, thanks
@elrion018
- Added
tagName parameter to custom element
attributeNameCheck, thanks @nelstrom
- Added better check for animated
href attributes, thanks
@llamakko
- Updated and improved the bundled types, thanks
@ssi02014
- Updated several tests to better align with new browser encoding
behaviors
- Improved the handling of potentially risky content inside CDATA
elements, thanks
@securityMB &
@terjanq
- Improved the regular expression for raw-text elements to cover
textareas, thanks
@securityMB &
@terjanq
DOMPurify 3.2.6
DOMPurify 3.2.5
- Added a check to the mXSS detection regex to be more strict, thanks
@masatokinugawa
- Added ESM type imports in source, removes patch function, thanks
@donmccurdy
- Added script to verify various TypeScript configurations, thanks
@reduckted
- Added more modern browsers to the Karma launchers list
- Added Node 23.x to tested runtimes, removed Node 17.x
- Fixed the generation of source maps, thanks
@reduckted
- Fixed an unexpected behavior with
ALLOWED_URI_REGEXP
using the 'g' flag, thanks @hhk-png
- Fixed a few typos in the README file
Commits
5e56114
Getting 3.x branch ready for 3.3.2 release (#1208)e8c95f4
fix: Fixed the broken package-lock.json9636037
Update package-lock.json5cad4ce
Getting 3.x branch ready for 3.3.2 releas (#1205)6fc446a
Merge pull request #1175
from cure53/main3b3bf91
Merge branch 'main' of github.com:cure53/DOMPurify9863f41
chore: Preparing 3.3.1 releaseb4e0295
chore: Preparing 3.3.0 release077746b
build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1170)4de68bb
build(deps): bump actions/checkout from 5 to 6 (#1171)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/chatwoot/chatwoot/network/alerts).
---------
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Shivam Mishra
Co-authored-by: Sojan Jose
---
pnpm-lock.yaml | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f1a6c7604..8816e6b9f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -2599,11 +2599,12 @@ packages:
glob@10.4.5:
resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==}
+ deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
hasBin: true
glob@7.2.3:
resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
- deprecated: Glob versions prior to v9 are no longer supported
+ deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
global-directory@4.0.1:
resolution: {integrity: sha512-wHTUcDUoZ1H5/0iVqEudYW4/kAlN5cZ3j/bXn0Dpbizl9iaUVeWSHqiOjsgk6OW2bkLclbBjzewBz6weQ1zA2Q==}
@@ -4585,6 +4586,7 @@ packages:
vue-i18n@9.14.5:
resolution: {integrity: sha512-0jQ9Em3ymWngyiIkj0+c/k7WgaPO+TNzjKSNq9BvBQaKJECqn9cd9fL4tkDhB5G1QBskGl9YxxbDAhgbFtpe2g==}
engines: {node: '>= 16'}
+ deprecated: v9 and v10 no longer supported. please migrate to v11. about maintenance status, see https://vue-i18n.intlify.dev/guide/maintenance.html
peerDependencies:
vue: ^3.0.0
@@ -4671,10 +4673,12 @@ packages:
whatwg-encoding@2.0.0:
resolution: {integrity: sha512-p41ogyeMUrw3jWclHWTQg1k05DSVXPLcVxRTYsXUk+ZooOCZLcoYgPZ/HL/D/N+uQPOtcp1me1WhBEaX02mhWg==}
engines: {node: '>=12'}
+ deprecated: Use @exodus/bytes instead for a more spec-conformant and faster implementation
whatwg-encoding@3.1.1:
resolution: {integrity: sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==}
engines: {node: '>=18'}
+ deprecated: Use @exodus/bytes instead for a more spec-conformant and faster implementation
whatwg-mimetype@3.0.0:
resolution: {integrity: sha512-nt+N2dzIutVRxARx1nghPKGv1xHikU7HKdfafKkLNLindmPU/ch3U31NOCGGA/dmPcmb1VlofO0vnKAcsm0o/Q==}