github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-03-11 17:48:44 -05:00
Code Issues 219 Packages Projects Releases 2 Wiki Activity

[PR #413] [CLOSED] chore(deps): bump dompurify from 3.2.3 to 3.2.4 in /frontend #727

New Issue
Closed
opened 2025-11-01 21:02:56 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2025-11-01 21:02:56 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/413
Author: @dependabot[bot]
Created: 2/21/2025
Status: ❌ Closed

Base: main ← Head: dependabot/npm_and_yarn/frontend/dompurify-3.2.4

📝 Commits (1)

  • 0656b5d chore(deps): bump dompurify from 3.2.3 to 3.2.4 in /frontend

📊 Changes

2 files changed (+10 additions, -10 deletions)

View changed files

📝 frontend/package.json (+1 -1)
📝 frontend/pnpm-lock.yaml (+9 -9)

📄 Description

Bumps dompurify from 3.2.3 to 3.2.4.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year
Commits
  • ec29e65 Merge pull request #1062 from cure53/main
  • 1c1b183 chore: Preparing 3.2.4 release
  • d18ffcb fix: Changed the template literal regex to avoid a config-dependent bypass
  • 0d64d2b Merge pull request #1060 from yehuya/initializeTestImprovements
  • 9ad7933 tests: DOMPurify custom window tests improvements
  • 72760ca Merge pull request #1059 from yehuya/fixMissingWindowElement
  • bc72d44 Fix tests
  • 363a89d fix: handle undefined Element in DOMPurify initialization
  • f41b45d Update LICENSE
  • b25bf26 Update README.md
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/413 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 2/21/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `dependabot/npm_and_yarn/frontend/dompurify-3.2.4` --- ### 📝 Commits (1) - [`0656b5d`](https://github.com/go-vikunja/vikunja/commit/0656b5daf59cad7870d47f583fba966264878a05) chore(deps): bump dompurify from 3.2.3 to 3.2.4 in /frontend ### 📊 Changes **2 files changed** (+10 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `frontend/package.json` (+1 -1) 📝 `frontend/pnpm-lock.yaml` (+9 -9) </details> ### 📄 Description Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.2.3 to 3.2.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.2.4</h2> <ul> <li>Fixed a conditional and config dependent mXSS-style <a href="https://nsysean.github.io/posts/dompurify-323-bypass/">bypass</a> reported by <a href="https://github.com/nsysean"><code>@​nsysean</code></a></li> <li>Added a new feature to allow specific hook removal, thanks <a href="https://github.com/davecardwell"><code>@​davecardwell</code></a></li> <li>Added <em>purify.js</em> and <em>purify.min.js</em> to exports, thanks <a href="https://github.com/Aetherinox"><code>@​Aetherinox</code></a></li> <li>Added better logic in case no window object is president, thanks <a href="https://github.com/yehuya"><code>@​yehuya</code></a></li> <li>Updated some dependencies called out by dependabot</li> <li>Updated license files etc to show the correct year</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/ec29e65f3675077c1a78e6edcab97f797f004a2e"><code>ec29e65</code></a> Merge pull request <a href="https://redirect.github.com/cure53/DOMPurify/issues/1062">#1062</a> from cure53/main</li> <li><a href="https://github.com/cure53/DOMPurify/commit/1c1b1838625851939d4b86436feeb3e3ccb7dbb6"><code>1c1b183</code></a> chore: Preparing 3.2.4 release</li> <li><a href="https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02"><code>d18ffcb</code></a> fix: Changed the template literal regex to avoid a config-dependent bypass</li> <li><a href="https://github.com/cure53/DOMPurify/commit/0d64d2b12f9ecaa28899c60aba0b9ed5072c4d93"><code>0d64d2b</code></a> Merge pull request <a href="https://redirect.github.com/cure53/DOMPurify/issues/1060">#1060</a> from yehuya/initializeTestImprovements</li> <li><a href="https://github.com/cure53/DOMPurify/commit/9ad79331566e0671788b120cc1f682f4e7f33f44"><code>9ad7933</code></a> tests: DOMPurify custom window tests improvements</li> <li><a href="https://github.com/cure53/DOMPurify/commit/72760ca8ee425c3129420390d4c10afe698ff2fb"><code>72760ca</code></a> Merge pull request <a href="https://redirect.github.com/cure53/DOMPurify/issues/1059">#1059</a> from yehuya/fixMissingWindowElement</li> <li><a href="https://github.com/cure53/DOMPurify/commit/bc72d44b2e3cec00d8ef2427869d03cb668969fa"><code>bc72d44</code></a> Fix tests</li> <li><a href="https://github.com/cure53/DOMPurify/commit/363a89dd3a051b72334cd4d0c867616fdc4ee40d"><code>363a89d</code></a> fix: handle undefined Element in DOMPurify initialization</li> <li><a href="https://github.com/cure53/DOMPurify/commit/f41b45df18a9666a50c1ad2662cee259230cfef4"><code>f41b45d</code></a> Update LICENSE</li> <li><a href="https://github.com/cure53/DOMPurify/commit/b25bf26d674ff4db9074cef01fc51490cb1369a0"><code>b25bf26</code></a> Update README.md</li> <li>Additional commits viewable in <a href="https://github.com/cure53/DOMPurify/compare/3.2.3...3.2.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.2.3&new-version=3.2.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/go-vikunja/vikunja/network/alerts). </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2025-11-01 21:02:56 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/caldav
area/filters
area/frontend
area/gantt
area/internal-code
area/typesense
bug
changes requested
confirmed
dependencies
enhancement
good first issue
help wanted
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#727
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?