Skip to content

chore(deps): update dependency dompurify to v3.4.4#5944

Merged
thomhurst merged 1 commit into
mainfrom
renovate/dompurify-3.x
May 17, 2026
Merged

chore(deps): update dependency dompurify to v3.4.4#5944
thomhurst merged 1 commit into
mainfrom
renovate/dompurify-3.x

Conversation

@thomhurst
Copy link
Copy Markdown
Owner

This PR contains the following updates:

Package Type Update Change
dompurify resolutions patch 3.4.33.4.4

Release Notes

cure53/DOMPurify (dompurify)

v3.4.4: DOMPurify 3.4.4

Compare Source

  • Added the selectedcontent element to default allow-list, thanks @​lukewarlow
  • Added the command and commandfor attributes to default allowed-list, thanks @​lukewarlow
  • Added better template scrubbing for IN_PLACE operations, thanks @​DEMON1A
  • Added stronger checks for cross-realm windows, thanks @​DEMON1A & @​fg0x0
  • Updated demo website and made sure it uses the latest from main
  • Updated existing workflows, fuzzer, dependabot, etc., added more tests
  • Bumped several dependencies where possible

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@thomhurst thomhurst added dependencies Pull requests that update a dependency file PATCH renovate-bot labels May 17, 2026
@thomhurst thomhurst enabled auto-merge (squash) May 17, 2026 10:57
@thomhurst thomhurst added dependencies Pull requests that update a dependency file PATCH renovate-bot labels May 17, 2026
@codacy-production
Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

Copy link
Copy Markdown
Contributor

@claude claude Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review: chore(deps): update dependency dompurify to v3.4.4

Verdict: Approve — routine Renovate patch update, safe to merge.

Summary

This PR bumps DOMPurify 3.4.3 → 3.4.4 in the docs/ website only. The core TUnit .NET library is not affected.

Changes Verified

File Change
docs/package.json Version pin updated: 3.4.33.4.4
docs/yarn.lock Integrity hash updated consistently (SHA-512 checksum matches the new release)

What 3.4.4 Brings

Per the release notes:

  • Security hardening: stronger cross-realm window checks and better IN_PLACE template scrubbing — good to have even in a docs context.
  • Minor allow-list additions (selectedcontent element, command/commandfor attributes) — no behavioral impact on the TUnit docs site.

No Issues Found

  • Lock file integrity hashes are properly updated and consistent.
  • Scope is limited to the docs subdirectory — zero risk to the TUnit library itself.
  • No previous review comments to address (first review on this PR).

This was referenced May 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file PATCH renovate-bot

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants