zeekay
41b0251fe4
Delete upstream workflows
...
This fork does not ship upstream's releases, and its hosted-runner jobs
never start here.
Claude-Session: https://claude.ai/code/session_01HuMDfgFssPUptYUzgZ6Cp8
2026-09-24 09:55:00 -07:00
zeekay and Hanzo Dev
d097f75c2c
ci: canonical pair — hanzo.yml + forge caller
...
github.com has no runner for hanzo-build-linux-amd64, so a caller under
.github/workflows is a gate that can never be scheduled. This is the ~7-line
caller on the plane that can (git.hanzo.ai git-runner fleet), pinned @v1.
Co-authored-by: Hanzo Dev <[email protected]
2026-08-06 02:26:46 -07:00
Cure53 and GitHub
0a707ecd2a
fix: addressed a possible DoS with IN_PLACE and KEEP_CONTENT, thanks @n2duc ( #1555 )
...
fix: fixed an OSV scanner false alert by updating the toml
2026-07-29 15:53:35 +02:00
3f7440416e
build(deps): bump the actions group with 6 updates ( #1547 )
...
Bumps the actions group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `7.0.0` | `7.0.1` |
| [github/codeql-action/init](https://github.com/github/codeql-action ) | `4.37.1` | `4.37.3` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action ) | `4.37.1` | `4.37.3` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action ) | `4.37.1` | `4.37.3` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action ) | `2.4.3` | `2.4.4` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) | `4.37.1` | `4.37.3` |
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1 )
Updates `github/codeql-action/init` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 )
Updates `github/codeql-action/autobuild` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 )
Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 )
Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md )
- [Commits](https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc )
Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/init
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/autobuild
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/analyze
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: ossf/scorecard-action
dependency-version: 2.4.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <[email protected]
2026-07-25 14:58:32 +02:00
Cure53 and GitHub
1028e47af4
Update OSV-Scanner configuration with new ignored vulnerabilities ( #1543 )
2026-07-22 13:10:03 +02:00
b2a9b59a78
build(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 ( #1542 )
...
Bumps [fast-uri](https://github.com/fastify/fast-uri ) from 3.1.2 to 3.1.4.
- [Release notes](https://github.com/fastify/fast-uri/releases )
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4 )
---
updated-dependencies:
- dependency-name: fast-uri
dependency-version: 3.1.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <[email protected]
2026-07-22 12:27:41 +02:00
62233049e4
build(deps): bump the actions group with 5 updates ( #1540 )
...
Bumps the actions group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.4.0` | `7.0.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action ) | `4.37.0` | `4.37.1` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action ) | `4.37.0` | `4.37.1` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action ) | `4.37.0` | `4.37.1` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) | `4.37.0` | `4.37.1` |
Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020 )
Updates `github/codeql-action/init` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a )
Updates `github/codeql-action/autobuild` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a )
Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a )
Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
- dependency-name: github/codeql-action/init
dependency-version: 4.37.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/autobuild
dependency-version: 4.37.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/analyze
dependency-version: 4.37.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <[email protected]
2026-07-20 16:14:59 +02:00
Cure53 and GitHub
f57b386c9c
release: 3.4.12 ( #1536 )
2026-07-11 13:45:45 +02:00
Cure53 and GitHub
044b58b401
fix: addressed an issue with hook-handling for CE sanitization ( #1527 )
...
* fix: addressed an issue with hook-handling for CE sanitization, thanks @Rikuxx0
* chore: rebuild dist to sync purify.min.js + sourcemaps after main merge
2026-07-11 13:23:47 +02:00
dc37bb1d02
build(deps): bump the actions group with 5 updates ( #1529 )
...
Bumps the actions group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner ) | `2.19.4` | `2.20.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action ) | `4.36.3` | `4.37.0` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action ) | `4.36.3` | `4.37.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action ) | `4.36.3` | `4.37.0` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) | `4.36.3` | `4.37.0` |
Updates `step-security/harden-runner` from 2.19.4 to 2.20.0
- [Release notes](https://github.com/step-security/harden-runner/releases )
- [Commits](https://github.com/step-security/harden-runner/compare/9af89fc71515a100421586dfdb3dc9c984fbf411...bf7454d06d71f1098171f2acdf0cd4708d7b5920 )
Updates `github/codeql-action/init` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9 )
Updates `github/codeql-action/autobuild` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9 )
Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9 )
Updates `github/codeql-action/upload-sarif` from 4.36.3 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9 )
---
updated-dependencies:
- dependency-name: step-security/harden-runner
dependency-version: 2.20.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: github/codeql-action/init
dependency-version: 4.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: github/codeql-action/autobuild
dependency-version: 4.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: github/codeql-action/analyze
dependency-version: 4.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
...
Signed-off-by: dependabot[bot] <[email protected] [email protected]
2026-07-11 13:01:58 +02:00
83bcf3eac7
Allow SVG dominant-baseline and text-orientation presentation attributes ( #1526 )
...
Both are pure presentation attributes from the W3C SVG2 text property
adaptions but were missing from the SVG attribute allow-list, so
DOMPurify stripped e.g. <text dominant-baseline="middle">. Their
baseline siblings alignment-baseline and baseline-shift are already
allow-listed; both added attributes are enum-only with no script/URL
surface.
Fixes #1525
Co-authored-by: Hanzo Dev <[email protected]
2026-07-11 12:45:59 +02:00
Cure53 and GitHub
866f9bac28
Cure53 inplace hardening 2 ( #1524 )
...
* * feat: block declarative-partial-updates patch directives
* feat: harden style mXSS check against foreign-content teleport
* fefend against declarative partial updates (Chrome 150)
* test: add tests for partial-update patch directives
* feat: loosened the style check a bit again
test: added correct test coverage for template scrubbing
* fix: slightly changed behavior of node removal to avoid breakage, see #1521
* chore: regenerated dist files to be in sync again
* fix: made sure that _neutralizeRoot calls _neutralizeSubtree first
* test: added tests for the formerly addressed IN_PLACE behavior
* chore: fixed the out-of-sync dist files
* chore: hardened against several smaller declarative patching crashes
* test: extended tests to cover more declarative patching cases
2026-07-09 21:03:01 +02:00
Cure53 and GitHub
c79bfe3272
Cure53 fix hook detach ( #1523 )
...
* * feat: block declarative-partial-updates patch directives
* feat: harden style mXSS check against foreign-content teleport
* fefend against declarative partial updates (Chrome 150)
* test: add tests for partial-update patch directives
* feat: loosened the style check a bit again
test: added correct test coverage for template scrubbing
* fix: slightly changed behavior of node removal to avoid breakage, see #1521
* chore: regenerated dist files to be in sync again
2026-07-07 11:26:27 +02:00
Cure53 and GitHub
03b4a15964
Cure53 proactive hardening against declarative partial updates ( #1516 )
...
* * feat: block declarative-partial-updates patch directives
* feat: harden style mXSS check against foreign-content teleport
* fefend against declarative partial updates (Chrome 150)
* test: add tests for partial-update patch directives
* feat: loosened the style check a bit again
test: added correct test coverage for template scrubbing
2026-07-07 10:18:08 +02:00
acdd5c9361
build(deps): bump the actions group with 4 updates ( #1518 )
...
Bumps the actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a )
Updates `github/codeql-action/autobuild` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a )
Updates `github/codeql-action/analyze` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a )
Updates `github/codeql-action/upload-sarif` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a )
---
updated-dependencies:
- dependency-name: github/codeql-action/init
dependency-version: 4.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/autobuild
dependency-version: 4.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/analyze
dependency-version: 4.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <[email protected]
2026-07-04 13:19:09 +02:00
8e4692a6b4
build(deps): bump actions/attest-build-provenance in the actions group ( #1513 )
...
Bumps the actions group with 1 update: [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance ).
Updates `actions/attest-build-provenance` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/actions/attest-build-provenance/releases )
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest-build-provenance/compare/a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32...0f67c3f4856b2e3261c31976d6725780e5e4c373 )
---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
dependency-version: 4.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions
...
Signed-off-by: dependabot[bot] <[email protected]
2026-06-27 16:09:36 +02:00
Cure53 and GitHub
f5cae2a6fd
Update Snyk.io package health badge in README ( #1511 )
...
Updated the Snyk.io package health badge to reflect the current score.
2026-06-24 12:59:08 +02:00
0b3e2f8eec
build(deps-dev): bump babel-plugin-istanbul from 5.2.0 to 8.0.0 ( #1505 )
...
Bumps [babel-plugin-istanbul](https://github.com/istanbuljs/babel-plugin-istanbul ) from 5.2.0 to 8.0.0.
- [Release notes](https://github.com/istanbuljs/babel-plugin-istanbul/releases )
- [Changelog](https://github.com/istanbuljs/babel-plugin-istanbul/blob/master/CHANGELOG.md )
- [Commits](https://github.com/istanbuljs/babel-plugin-istanbul/compare/v5.2.0...v8.0.0 )
---
updated-dependencies:
- dependency-name: babel-plugin-istanbul
dependency-version: 8.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <[email protected] [email protected]
2026-06-20 17:55:29 +02:00
23c91d51a6
build(deps-dev): bump rollup in the dev-dependencies group ( #1504 )
...
Bumps the dev-dependencies group with 1 update: [rollup](https://github.com/rollup/rollup ).
Updates `rollup` from 4.62.0 to 4.62.2
- [Release notes](https://github.com/rollup/rollup/releases )
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md )
- [Commits](https://github.com/rollup/rollup/compare/v4.62.0...v4.62.2 )
---
updated-dependencies:
- dependency-name: rollup
dependency-version: 4.62.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-dependencies
...
Signed-off-by: dependabot[bot] <[email protected]
2026-06-20 17:49:58 +02:00
243fa386ee
build(deps-dev): bump @types/node from 25.9.3 to 26.0.0 ( #1499 )
...
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) from 25.9.3 to 26.0.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 26.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <[email protected] [email protected]
2026-06-19 13:42:49 +02:00
2e5816ccad
build(deps-dev): bump undici from 7.25.0 to 7.28.0 ( #1503 )
...
Bumps [undici](https://github.com/nodejs/undici ) from 7.25.0 to 7.28.0.
- [Release notes](https://github.com/nodejs/undici/releases )
- [Commits](https://github.com/nodejs/undici/compare/v7.25.0...v7.28.0 )
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.28.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <[email protected] [email protected]
2026-06-19 13:38:22 +02:00
4333c4ade8
build(deps-dev): bump the dev-dependencies group with 3 updates ( #1498 )
...
Bumps the dev-dependencies group with 3 updates: [@playwright/test](https://github.com/microsoft/playwright ), [happy-dom](https://github.com/capricorn86/happy-dom ) and [rollup](https://github.com/rollup/rollup ).
Updates `@playwright/test` from 1.60.0 to 1.61.0
- [Release notes](https://github.com/microsoft/playwright/releases )
- [Commits](https://github.com/microsoft/playwright/compare/v1.60.0...v1.61.0 )
Updates `happy-dom` from 20.10.2 to 20.10.6
- [Release notes](https://github.com/capricorn86/happy-dom/releases )
- [Commits](https://github.com/capricorn86/happy-dom/compare/v20.10.2...v20.10.6 )
Updates `rollup` from 4.61.1 to 4.62.0
- [Release notes](https://github.com/rollup/rollup/releases )
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md )
- [Commits](https://github.com/rollup/rollup/compare/v4.61.1...v4.62.0 )
---
updated-dependencies:
- dependency-name: "@playwright/test"
dependency-version: 1.61.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: dev-dependencies
- dependency-name: happy-dom
dependency-version: 20.10.6
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-dependencies
- dependency-name: rollup
dependency-version: 4.62.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: dev-dependencies
...
Signed-off-by: dependabot[bot] <[email protected] [email protected]
2026-06-19 13:32:21 +02:00
c8b7339948
build(deps): bump actions/checkout in the actions group ( #1497 )
...
Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout ).
Updates `actions/checkout` from 6.0.3 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions
...
Signed-off-by: dependabot[bot] <[email protected]
2026-06-19 13:27:55 +02:00
Cure53 and GitHub
8a565c0454
release: 3.4.11 ( #1493 )
...
* release: 3.4.11
* updated README
2026-06-17 11:23:04 +02:00
Cure53 and GitHub
5c76e10187
chore: modified the packages.json again to get rid of vulnerable deps ( #1491 )
2026-06-16 17:16:24 +02:00
Cure53 and GitHub
143b927944
chore: added override for vulnerable dep to get rid of it ( #1489 )
...
chore: cleaned up the osv scanner exclusions
2026-06-16 16:40:02 +02:00
Cure53 and GitHub
64ad312b2a
chore: added override for vulnerable dep to get rid of it ( #1487 )
2026-06-16 15:47:48 +02:00
e12f66240a
build(deps): bump uuid and nyc ( #1485 )
...
Removes [uuid](https://github.com/uuidjs/uuid ). It's no longer used after updating ancestor dependency [nyc](https://github.com/istanbuljs/nyc ). These dependencies need to be updated together.
Removes `uuid`
Updates `nyc` from 14.1.1 to 18.0.0
- [Release notes](https://github.com/istanbuljs/nyc/releases )
- [Changelog](https://github.com/istanbuljs/nyc/blob/main/CHANGELOG.md )
- [Commits](https://github.com/istanbuljs/nyc/compare/v14.1.1...nyc-v18.0.0 )
---
updated-dependencies:
- dependency-name: uuid
dependency-version:
dependency-type: indirect
- dependency-name: nyc
dependency-version: 18.0.0
dependency-type: direct:development
...
Signed-off-by: dependabot[bot] <[email protected] [email protected]
2026-06-16 14:57:45 +02:00
4c38b5ae55
build(deps): bump js-yaml and nyc ( #1486 )
...
Bumps [js-yaml](https://github.com/nodeca/js-yaml ) to 4.2.0 and updates ancestor dependency [nyc](https://github.com/istanbuljs/nyc ). These dependencies need to be updated together.
Updates `js-yaml` from 3.14.2 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md )
- [Commits](https://github.com/nodeca/js-yaml/commits )
Updates `nyc` from 14.1.1 to 18.0.0
- [Release notes](https://github.com/istanbuljs/nyc/releases )
- [Changelog](https://github.com/istanbuljs/nyc/blob/main/CHANGELOG.md )
- [Commits](https://github.com/istanbuljs/nyc/compare/v14.1.1...nyc-v18.0.0 )
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.2.0
dependency-type: indirect
- dependency-name: nyc
dependency-version: 18.0.0
dependency-type: direct:development
...
Signed-off-by: dependabot[bot] <[email protected]
2026-06-16 14:45:28 +02:00
Cure53 and GitHub
0ff9c069a1
chore: updated several dependencies with sec issues ( #1484 )
2026-06-16 14:38:39 +02:00
Cure53 and GitHub
c1815ac6e2
Fix links in SECURITY.md for threat model and attack class ( #1483 )
...
Updated links in the SECURITY.md document to point to the relevant wiki pages.
2026-06-13 18:27:53 +02:00
Cure53 and GitHub
ae9f24044c
fix: hook allowlist clone-guard now covers the setConfig() path ( #1482 )
...
* fix: hook allowlist clone-guard now covers the setConfig() path
* test: added test coverage for recent config leak fixes
* fix: hardened the entry points for hooks
* docs: updated threat model docs to be more accurate regarding exotic configs
2026-06-13 17:14:36 +02:00
Cure53 and GitHub
206da3d65b
release: 3.4.10 ( #1477 )
2026-06-12 13:49:52 +02:00
Cure53 and GitHub
adecaa0e37
chore: refactoring run pt4, demo touchup, docs, comments, small things ( #1476 )
2026-06-12 12:41:53 +02:00
Cure53 and GitHub
9ef570a0d4
chore: refactoring run pt3, performance, de-dos, micro optimizations ( #1475 )
2026-06-12 12:11:53 +02:00
Cure53 and GitHub
b187055a13
chore: refactoring run pt2, methods, structure, more dedup ( #1474 )
2026-06-12 11:07:51 +02:00
Cure53 and GitHub
4112e9d87c
chore: refactoring run pt1, types, typos and dedup ( #1473 )
...
refactor: extract public type declarations into src/types.ts
Moves the type-level code (DOMPurify interface, hook types,
RemovedElement/RemovedAttribute, WindowLike, HooksMap) from the bottom
of purify.ts into src/types.ts. purify.ts imports what it references
and re-exports the public surface unchanged.
No emitted-JS change: all four runtime bundles rebuild byte-identical.
Bundled d.ts is semantically identical (only 'declare const _default'
moves after the type block). verify-typescript passes for all consumer
flavors.
refactor: single source of truth for integration point defaults
The default MATHML_TEXT_INTEGRATION_POINTS and HTML_INTEGRATION_POINTS
arrays were written twice - at declaration and inline in _parseConfig.
Extract frozen DEFAULT_* constants (elements already lowercase, so
addToSet's isFrozen guard is a no-op) referenced from both sites. A
fresh set object is still allocated per parse, exactly as before.
refactor: remove dead branches, fix internal naming, align hardened style
- _isValidAttribute: drop the FORBID_ATTR[lcName] re-checks; both sit
after the unconditional early return and FORBID_ATTR cannot change
between the two points, so they were constants.
- Remove unreachable direct-property fallbacks on getChildNodes /
getAttributes / getShadowRoot: lookupGetter always returns a
callable, and the dead fallback was the clobberable read. The
nullable getNodeType/getNodeName ternaries stay.
- NODE_TYPE.progressingInstruction -> processingInstruction (internal).
- seal() the per-config CUSTOM_ELEMENT_HANDLING, matching the sealed
initial declaration; drop bare Array.from in
_scrubTemplateExpressions (static NodeList via unapplied forEach is
an identical snapshot).
2026-06-11 23:58:45 +02:00
965398fae1
build(deps-dev): bump the dev-dependencies group with 3 updates ( #1468 )
...
Bumps the dev-dependencies group with 3 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ), [happy-dom](https://github.com/capricorn86/happy-dom ) and [prettier](https://github.com/prettier/prettier ).
Updates `@types/node` from 25.9.2 to 25.9.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
Updates `happy-dom` from 20.10.1 to 20.10.2
- [Release notes](https://github.com/capricorn86/happy-dom/releases )
- [Commits](https://github.com/capricorn86/happy-dom/compare/v20.10.1...v20.10.2 )
Updates `prettier` from 3.8.3 to 3.8.4
- [Release notes](https://github.com/prettier/prettier/releases )
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md )
- [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.8.4 )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.9.3
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-dependencies
- dependency-name: happy-dom
dependency-version: 20.10.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-dependencies
- dependency-name: prettier
dependency-version: 3.8.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-dependencies
...
Signed-off-by: dependabot[bot] <[email protected] [email protected]
2026-06-11 18:34:59 +02:00
Cure53 and GitHub
83c269bbd8
Added osv-scanner.toml for the legacy Playwright ( #1471 )
2026-06-11 18:22:40 +02:00
eba6ab28fd
build(deps): bump sigstore/gh-action-sigstore-python ( #1467 )
...
Bumps the actions group with 1 update: [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python ).
Updates `sigstore/gh-action-sigstore-python` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/sigstore/gh-action-sigstore-python/releases )
- [Changelog](https://github.com/sigstore/gh-action-sigstore-python/blob/main/CHANGELOG.md )
- [Commits](https://github.com/sigstore/gh-action-sigstore-python/compare/04cffa1d795717b140764e8b640de88853c92acc...5b79a39c381910c090341a2c9b0bf022c8b387e1 )
---
updated-dependencies:
- dependency-name: sigstore/gh-action-sigstore-python
dependency-version: 3.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
...
Signed-off-by: dependabot[bot] <[email protected]
2026-06-11 18:11:52 +02:00
Cure53 and GitHub
14e81720d6
Refactor dependabot.yml comments and update types ( #1466 )
...
* Refactor dependabot.yml comments and update types
Updated comments for clarity and adjusted patch update type.
* Add new ignored vulnerability entry in osv-scanner.toml
2026-06-11 18:06:57 +02:00
Cure53 and GitHub
41a4847121
Update package description for DOMPurify ( #1465 )
2026-06-11 17:31:30 +02:00
Cure53 and GitHub
2ad7b62830
Cure53 test coverage ( #1464 )
...
* test: added tooling for tracking and measuring test coverage
* test: increased test coverage by ca. 5%, likely reaching max possible
* test: added missing dist file for test runner
* test: fixed the missing dist scripts
* test: finally found the missing dist issue and fixed the rollup config
2026-06-11 16:49:27 +02:00
Cure53 and GitHub
da787c8990
Update README.md ( #1463 )
...
* Update README.md
* Add OpenSSF badges to project section
2026-06-10 15:19:54 +02:00
Cure53 and GitHub
67a116ab2a
chore: fixed a missing pinned dependency ( #1462 )
...
chore: gave the webiste a small touch-up
2026-06-10 15:11:31 +02:00
Cure53 and GitHub
e392489cdc
test: added coverage tests for older browsers as well, added workflow ( #1461 )
...
* test: added coverage tests for older browsers as well, added workflow
* chore: made sure the new tests run upon merge into main
* doc: updated README with latest info on legacy browser tests
* chore: further fine-tuned the workflows and when they are supposed to run
2026-06-10 13:01:13 +02:00
Cure53 and GitHub
4b6ab47f27
release: 3.4.9 ( #1458 )
2026-06-10 10:27:20 +02:00
Cure53 and GitHub
725b28ef90
Update contributor list in README.md ( #1456 )
2026-06-06 19:56:31 +02:00
Cure53 and GitHub
e369a7d61b
Enhance README with security usage details ( #1454 )
...
Added additional context regarding the security implications of using DOMPurify
2026-06-06 18:50:43 +02:00
Cure53 and GitHub
52cb1f7c62
fix: added further robustness for exotic IN_PLACE usage ( #1453 )
...
* fix: added further robustness for exotic IN_PLACE usage
test: expanded test suite accordingly
* chore: refactored the code a bit after recent IN_PLACE changes
* fix: added enhanced robustness after recent IN_PLACE audit
test: expanded the array of IN_PLACE tests accordingly
2026-06-06 18:08:49 +02:00
zeekay
