From 9c8cfc40b6380be66e3e1c426a84ff8b1b21342e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 6 May 2026 15:14:54 +0530
Subject: [PATCH] chore(deps): bump dompurify from 3.3.2 to 3.4.0 (#14074)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.3.2 to
3.4.0.
Release notes
Sourced from dompurify's
releases.
DOMPurify 3.4.0
Most relevant changes:
- Fixed a problem with
FORBID_TAGS not winning over
ADD_TAGS, thanks @kodareef5
- Fixed several minor problems and typos regarding MathML attributes,
thanks
@DavidOliver
- Fixed
ADD_ATTR/ADD_TAGS function leaking
into subsequent array-based calls, thanks @1Jesper1
- Fixed a missing
SAFE_FOR_TEMPLATES scrub in
RETURN_DOM path, thanks @bencalif
- Fixed a prototype pollution via
CUSTOM_ELEMENT_HANDLING, thanks @trace37labs
- Fixed an issue with
ADD_TAGS function form bypassing
FORBID_TAGS, thanks @eddieran
- Fixed an issue with
ADD_ATTR predicates skipping URI
validation, thanks @christos-eth
- Fixed an issue with
USE_PROFILES prototype pollution,
thanks @christos-eth
- Fixed an issue leading to possible mXSS via Re-Contextualization,
thanks
@researchatfluidattacks
and others
- Fixed an issue with closing tags leading to possible mXSS, thanks
@frevadiscor
- Fixed a problem with the type dentition patcher after Node version
bump
- Fixed freezing BS runs by reducing the tested browsers array
- Bumped several dependencies where possible
- Added needed files for OpenSSF scorecard checks
Published Advisories are here:
https://github.com/cure53/DOMPurify/security/advisories?state=published
DOMPurify 3.3.3
- Fixed an engine requirement for Node 20 which caused hiccups, thanks
@Rotzbua
Commits
5b16e0b
Getting 3.x branch ready for 3.4.0 release (#1250)8bcbf73
chore: Preparing 3.3.3 release5faddd6
fix: engine requirement (#1210)0f91e3a
Update README.mdd5ff1a8
Merge branch 'main' of github.com:cure53/DOMPurifyc3efd48
fix: moved back from jsdom 28 to jsdom 20988b888
fix: moved back from jsdom 28 to jsdom 202726c74
chore: Preparing 3.3.2 release6202c7e
build(deps): bump @tootallnate/once and jsdom (#1204)302b51d
fix: Expanded the regex ever so slightly to also cover script- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/chatwoot/chatwoot/network/alerts).
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>
---
package.json | 2 +-
pnpm-lock.yaml | 13 ++++++-------
2 files changed, 7 insertions(+), 8 deletions(-)
diff --git a/package.json b/package.json
index bb5b59ba3..35e09cfbc 100644
--- a/package.json
+++ b/package.json
@@ -68,7 +68,7 @@
"countries-and-timezones": "^3.6.0",
"date-fns": "2.21.1",
"date-fns-tz": "^1.3.3",
- "dompurify": "3.3.2",
+ "dompurify": "3.4.0",
"flag-icons": "^7.2.3",
"floating-vue": "^5.2.2",
"highlight.js": "^11.10.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2a3aee897..d76d0a061 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -128,8 +128,8 @@ importers:
specifier: ^1.3.3
version: 1.3.8(date-fns@2.21.1)
dompurify:
- specifier: 3.3.2
- version: 3.3.2
+ specifier: 3.4.0
+ version: 3.4.0
flag-icons:
specifier: ^7.2.3
version: 7.2.3
@@ -2194,9 +2194,8 @@ packages:
resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==}
engines: {node: '>= 4'}
- dompurify@3.3.2:
- resolution: {integrity: sha512-6obghkliLdmKa56xdbLOpUZ43pAR6xFy1uOrxBaIDjT+yaRuuybLjGS9eVBoSR/UPU5fq3OXClEHLJNGvbxKpQ==}
- engines: {node: '>=20'}
+ dompurify@3.4.0:
+ resolution: {integrity: sha512-nolgK9JcaUXMSmW+j1yaSvaEaoXYHwWyGJlkoCTghc97KgGDDSnpoU/PlEnw63Ah+TGKFOyY+X5LnxaWbCSfXg==}
domutils@3.1.0:
resolution: {integrity: sha512-H78uMmQtI2AhgDJjWeQmHwJJ2bLPD3GMmO7Zja/ZZh84wkm+4ut+IUnUdRa8uCGX88DiVx1j6FRe1XfxEgjEZA==}
@@ -6861,7 +6860,7 @@ snapshots:
dependencies:
domelementtype: 2.3.0
- dompurify@3.3.2:
+ dompurify@3.4.0:
optionalDependencies:
'@types/trusted-types': 2.0.7
@@ -9656,7 +9655,7 @@ snapshots:
vue-dompurify-html@5.3.0(vue@3.5.12(typescript@5.6.2)):
dependencies:
- dompurify: 3.3.2
+ dompurify: 3.4.0
vue: 3.5.12(typescript@5.6.2)
vue-eslint-parser@9.4.3(eslint@8.57.0):