From 072f1e9b8e4044d184b91fd731925c79d7451f00 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 10:03:46 -0700
Subject: [PATCH] build(deps): bump dompurify from 3.4.8 to 3.4.12 (#9478)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.8 to
3.4.12.
Release notes
Sourced from dompurify's
releases.
DOMPurify 3.4.12
- Fixed an issue where a hook would not get called for custom
elements, thanks
@Rikuxx0
- Hardened the handling of hooks removing elements,
@mkrause-bee360
- Added support for a few new SVG attributes, thanks
@cbn-falias &
@Develop-KIM
- Hardened the handling of declarative partial updates
- Updated the documentation is several spots, README, wiki, etc.
- Bumped several dependencies where possible
DOMPurify 3.4.11
- Fixed an issue with a leaky config for hooks via
setConfig, thanks @trace37labs
- Bumped vulnerable development dependencies to arrive at plain 0 with
npm audit
- Updated the
osv-scanner suppression list as no
vulnerable dependencies are left for now
- Updated up the linting tool-chain and removed now-redundant lint
directives
- Updated the documentation is several spots, README, wiki, etc.
- Bumped several dependencies where possible
DOMPurify 3.4.10
- Refactored codebase for clarity: extracted the public type
declarations into
types.ts
- Decomposed the three largest sanitizer functions into focused
helpers
- Removed duplicated defaults and dead branches, consolidated
SAFE_FOR_TEMPLATES scrubbing into single shared path
- Improved per-node performance by hoisting the mXSS probe regexes and
testing
textContent before innerHTML
- Added a deterministic micro-benchmark harness (
npm run
bench) with a --compare mode
- Reduced CI cost by running the full three-engine browser suite once
per PR
- Refreshed the
demos/ folder so every demo runs again,
and added a SVG-via-<img> demo
- Documented the bench and
test:happydom scripts in the
README
- Completed the Attack Classes & Bypass History wiki page
- Bumped several dependencies where possible
DOMPurify 3.4.9
- Further improved the handling of Trusted Types config options,
thanks
@offset
- Further improved the handling of
IN_PLACE sanitization,
thanks @mozfreddyb
- Added more test coverage for
IN_PLACE and Trusted Types
related usage
- Bumped several dependencies where possible
- Updated README and wiki with more accurate documentation &
attack samples
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pnpm-lock.yaml | 19 ++++++-------------
server/package.json | 2 +-
2 files changed, 7 insertions(+), 14 deletions(-)
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4d18196b71..b67ddd808d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -742,8 +742,8 @@ importers:
specifier: ^2.1.0
version: 2.1.0
dompurify:
- specifier: ^3.4.8
- version: 3.4.8
+ specifier: ^3.4.12
+ version: 3.4.12
dotenv:
specifier: ^17.4.2
version: 17.4.2
@@ -5757,11 +5757,8 @@ packages:
dom-accessibility-api@0.6.3:
resolution: {integrity: sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w==}
- dompurify@3.4.11:
- resolution: {integrity: sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==}
-
- dompurify@3.4.8:
- resolution: {integrity: sha512-yb1cEmaOum7wFvOCSQxyfgVlv5D47Rc30iZWoMpbDIWTnJ6grDDQyu2KFJzB2k7u0pMuJcQ1zphH//fFnw2tjQ==}
+ dompurify@3.4.12:
+ resolution: {integrity: sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==}
dotenv@16.6.1:
resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
@@ -13133,11 +13130,7 @@ snapshots:
dom-accessibility-api@0.6.3: {}
- dompurify@3.4.11:
- optionalDependencies:
- '@types/trusted-types': 2.0.7
-
- dompurify@3.4.8:
+ dompurify@3.4.12:
optionalDependencies:
'@types/trusted-types': 2.0.7
@@ -14255,7 +14248,7 @@ snapshots:
d3-sankey: 0.12.3
dagre-d3-es: 7.0.14
dayjs: 1.11.21
- dompurify: 3.4.11
+ dompurify: 3.4.12
es-toolkit: 1.49.0
katex: 0.16.47
khroma: 2.1.0
diff --git a/server/package.json b/server/package.json
index 943251ef4b..1c68dce032 100644
--- a/server/package.json
+++ b/server/package.json
@@ -64,7 +64,7 @@
"better-auth": "1.6.23",
"chokidar": "^4.0.3",
"detect-port": "^2.1.0",
- "dompurify": "^3.4.8",
+ "dompurify": "^3.4.12",
"dotenv": "^17.4.2",
"drizzle-orm": "^0.45.2",
"embedded-postgres": "^18.1.0-beta.16",