[Snyk] Upgrade dompurify from 2.0.15 to 2.4.3 #3

qmutz · 2023-02-27T17:50:56Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade dompurify from 2.0.15 to 2.4.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 31 versions ahead of your current version.
The recommended version was released 2 months ago, on 2023-01-06.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-1016634	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-1035544	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	No Known Exploit
Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-2863266	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: dompurify

2.4.3 - 2023-01-06
- Final release that is compatible with MSIE10 & MSIE 11
2.4.2 - 2023-01-05
- Fixed a Trusted Types sink violation with empty input and NAMESPACE , thanks @ tosmolka
- Fixed a Prototype Pollution issue discovered and reported by @ kevin-mizu
2.4.1 - 2022-11-10
- Added new config option ALLOWED_NAMESPACES for better XML handling, thanks @ kevin-deyoungster @ tosmolka
- Added better detection of template literals when SAFE_FOR_TEMPLATES is true
- Fixed an exception caused by DOM clobbering, thanks @ masatokinugawa
- Bumped some dependencies, thanks @ marcpenya-tf
2.4.0 - 2022-08-24
- Removed bundled types again as they caused too much trouble
2.3.12 - 2022-08-23
- Fixed an issue in 2.3.11 causing errors w. TypeScript, see #712, thanks @ Mirco469, @ brentkeller, @ aryanisml
2.3.11 - 2022-08-23
- Added generated type definitions for better compatibility
- Added SANITIZE_NAMED_PROPS config option, thanks @ SoheilKhodayari
- Updated README and config documentation, thanks @ 0xedward
- Updated test suite with newer Node versions
2.3.10 - 2022-07-18
2.3.9 - 2022-07-11
2.3.8 - 2022-05-13
2.3.7 - 2022-05-11
2.3.6 - 2022-02-16
2.3.5 - 2022-01-26
2.3.4 - 2021-12-07
2.3.3 - 2021-09-20
2.3.2 - 2021-09-15
2.3.1 - 2021-08-13
2.3.0 - 2021-07-06
2.2.9 - 2021-06-01
2.2.8 - 2021-04-28
2.2.7 - 2021-03-12
2.2.6 - 2020-12-18
2.2.5 - 2020-12-18
2.2.4 - 2020-12-15
2.2.3 - 2020-12-07
2.2.2 - 2020-11-02
2.2.1 - 2020-11-02
2.2.0 - 2020-10-21
2.1.1 - 2020-09-25
2.1.0 - 2020-09-23
2.0.17 - 2020-09-20
2.0.16 - 2020-09-18
2.0.15 - 2020-09-03

from dompurify GitHub release notes

Commit messages

Package name: dompurify

90326ef Merge pull request Faster / auto refresh of stacks nextcloud/deck#750 from cure53/dependabot/npm_and_yarn/json5-1.0.2
fade506 chore: Prepare 2.4.3, final feature release compatible w. MSIE10/11
3afe389 build(deps): bump json5 from 1.0.1 to 1.0.2
f1e180f fix: merged from latest main
7707778 Update README.md
5267b04 chore: Preparing 2.4.2 release
d1dd037 fix: Fixed a prototype pollution bug reported by @ kevin_mizu
24d2a7f Merge pull request Update css-loader requirement from ^0.28.11 to ^1.0.1 nextcloud/deck#748 from tosmolka/tosmolka/747
7de86a0 Fix formatting
191cc00 Fix Trusted Types Sink violation with empty input and NAMESPACE
4945074 Merge pull request Timeline is cluttered up by autosave nextcloud/deck#745 from cure53/dependabot/npm_and_yarn/qs-and-body-parser-6.11.0
7e9fcd9 build(deps): bump qs and body-parser
2734b2d Merge pull request user permissions unclear nextcloud/deck#737 from cure53/dependabot/npm_and_yarn/engine.io-and-socket.io-6.2.1
f3b68d9 build(deps): bump engine.io and socket.io
9a751e4 Merge pull request Fix CI build nextcloud/deck#732 from Pomierski/patch-1
2c03b6c fix
7477926 chore: fix allowCustomizedBuiltInElements comment in readme
67f784c chore: preparing 2.4.1 release
e50e814 Merge pull request Papercut: remove duplicate blanks nextcloud/deck#731 from cure53/dependabot/npm_and_yarn/minimatch-3.1.2
4712fa3 test: attempted to fix ALLOWED_NAMESPACES tests for IE/Edge v2
48d009c test: attempted to fix ALLOWED_NAMESPACES tests for IE/Edge
36eb7c3 build(deps): bump minimatch from 3.0.4 to 3.1.2
16232f0 Merge pull request Indicate on a card that comments were made nextcloud/deck#730 from cure53/dependabot/npm_and_yarn/socket.io-parser-4.0.5
5f77429 Merge pull request Papercut: remove double blanks "Create board" nextcloud/deck#729 from kevin-deyoungster/kdeyoungster/xml