Skip to content

Commit 5b0cdbb

Browse files
cure53cure53
authored
chore: merge main into 3.x for 3.4.1 release (#1301)
* chore: merge main into 3.x for 3.4.1 release * ci: run CodeQL on 2.x and 3.x branches
1 parent 09f5911 commit 5b0cdbb

46 files changed

Lines changed: 4355 additions & 5443 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build-and-test.yml‎

Lines changed: 71 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ permissions:
1212
contents: read
1313

1414
jobs:
15+
# Fast feedback: lint, jsdom, chromium-only browser test across Node versions.
16+
# Runs on every push and every PR.
1517
install:
1618
runs-on: ubuntu-latest
1719

@@ -21,7 +23,7 @@ jobs:
2123

2224
steps:
2325
- name: Harden the runner (Audit all outbound calls)
24-
uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
26+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
2527
with:
2628
egress-policy: audit
2729

@@ -37,19 +39,81 @@ jobs:
3739
- name: Install Dependencies
3840
run: npm ci
3941

42+
- name: Install Playwright Browsers
43+
run: ./node_modules/.bin/playwright install --with-deps chromium firefox webkit
44+
4045
- name: Build
4146
run: npm run build
4247

4348
- name: Lint
4449
run: npm run lint
4550

4651
- name: Test
47-
run: xvfb-run -a npm run test:ci
48-
env:
49-
TEST_BROWSERSTACK: ${{ startsWith(matrix.node-version, '25') }}
50-
TEST_PROBE_ONLY: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/2.x' }}
51-
BS_USERNAME: ${{ secrets.BS_USERNAME }}
52-
BS_ACCESSKEY: ${{ secrets.BS_ACCESSKEY }}
52+
run: npm run test:ci
53+
54+
- name: Upload Playwright report
55+
if: failure()
56+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
57+
with:
58+
name: playwright-report-node-${{ matrix.node-version }}
59+
path: playwright-report/
60+
retention-days: 7
5361

5462
- name: Verify TypeScript
5563
run: npm run verify-typescript
64+
65+
# Browser diversity: chromium + firefox + webkit across Ubuntu, macOS, and
66+
# Windows. Catches OS-specific rendering quirks (e.g. macOS WebKit ≈ real
67+
# Safari engine, Windows font shaping, Linux-specific parser paths).
68+
#
69+
# Only runs on release branches (main, 2.x, 3.x) to conserve runner minutes.
70+
# PRs get chromium-only coverage from the "install" job above, which is
71+
# sufficient for catching regressions.
72+
browser-matrix:
73+
if: github.event_name == 'push'
74+
runs-on: ${{ matrix.os }}
75+
76+
strategy:
77+
fail-fast: false
78+
matrix:
79+
os: [ubuntu-latest, macos-latest, windows-latest]
80+
81+
steps:
82+
- name: Harden the runner (Audit all outbound calls)
83+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
84+
with:
85+
egress-policy: audit
86+
87+
- name: Checkout
88+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
89+
90+
- name: Setup Node.js 25.x
91+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
92+
with:
93+
node-version: 25.x
94+
cache: npm
95+
96+
- name: Install Dependencies
97+
run: npm ci
98+
99+
- name: Install Playwright Browsers (Linux)
100+
if: runner.os == 'Linux'
101+
run: ./node_modules/.bin/playwright install --with-deps chromium firefox webkit
102+
103+
- name: Install Playwright Browsers (macOS / Windows)
104+
if: runner.os != 'Linux'
105+
run: ./node_modules/.bin/playwright install chromium firefox webkit
106+
107+
- name: Build
108+
run: npm run build
109+
110+
- name: Run browser tests (all engines)
111+
run: npm run test:browser
112+
113+
- name: Upload Playwright report
114+
if: failure()
115+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
116+
with:
117+
name: playwright-report-${{ matrix.os }}
118+
path: playwright-report/
119+
retention-days: 7

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ name: "CodeQL"
22

33
on:
44
push:
5-
branches: [main]
5+
branches: [main, 2.x, 3.x]
66
pull_request:
77
# The branches below must be a subset of the branches above
8-
branches: [main]
8+
branches: [main, 2.x, 3.x]
99
schedule:
1010
- cron: '0 19 * * 4'
1111

@@ -32,7 +32,7 @@ jobs:
3232

3333
steps:
3434
- name: Harden the runner (Audit all outbound calls)
35-
uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
35+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
3636
with:
3737
egress-policy: audit
3838

@@ -50,14 +50,14 @@ jobs:
5050

5151
# Initializes the CodeQL tools for scanning.
5252
- name: Initialize CodeQL
53-
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
53+
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
5454
with:
5555
languages: ${{ matrix.language }}
5656

5757
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5858
# If this step fails, then you should remove it and run the build manually (see below)
5959
- name: Autobuild
60-
uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
60+
uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
6161

6262
# ℹ️ Command-line programs to run using the OS shell.
6363
# 📚 https://git.io/JvXDl
@@ -71,4 +71,4 @@ jobs:
7171
# make release
7272

7373
- name: Perform CodeQL Analysis
74-
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
74+
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2

‎.github/workflows/dependency-review.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: Harden the runner (Audit all outbound calls)
20-
uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
20+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
2121
with:
2222
egress-policy: audit
2323

‎.github/workflows/fuzz.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Fuzz
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches:
7+
- main
8+
schedule:
9+
- cron: '23 3 * * *'
10+
workflow_dispatch:
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
fuzz:
17+
runs-on: ubuntu-latest
18+
strategy:
19+
matrix:
20+
node-version: [20.x, 24.x]
21+
steps:
22+
- name: Harden the runner
23+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
30+
- name: Setup Node.js
31+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
32+
with:
33+
node-version: ${{ matrix.node-version }}
34+
cache: npm
35+
36+
- name: Install dependencies
37+
run: npm ci
38+
39+
- name: Build
40+
run: npm run build
41+
42+
- name: Run fuzzing
43+
run: FUZZ_RUNS=300 npm run test:fuzz

‎.github/workflows/scorecard.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434

3535
steps:
3636
- name: Harden the runner (Audit all outbound calls)
37-
uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
37+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
3838
with:
3939
egress-policy: audit
4040

@@ -78,6 +78,6 @@ jobs:
7878
# Upload the results to GitHub's code scanning dashboard (optional).
7979
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
8080
- name: "Upload to code-scanning"
81-
uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
81+
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
8282
with:
8383
sarif_file: results.sarif

‎.husky/pre-commit‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
npm run lint
2+
npm run build
3+
npm run commit-amend-build

‎.settings/.gitignore‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎CODEOWNERS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# .github/CODEOWNERS
2+
# All changes require review from a core maintainer
3+
* @x00mario

‎LICENSE‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
DOMPurify
2-
Copyright 2025 Dr.-Ing. Mario Heiderich, Cure53
2+
Copyright 2025-2026 Dr.-Ing. Mario Heiderich, Cure53
33

44
DOMPurify is free software; you can redistribute it and/or modify it under the
55
terms of either:
@@ -197,7 +197,7 @@ b) the Mozilla Public License Version 2.0
197197
same "printed page" as the copyright notice for easier
198198
identification within third-party archives.
199199

200-
Copyright [yyyy] [name of copyright owner]
200+
Copyright 2025-2026 Dr.-Ing. Mario Heiderich, Cure53
201201

202202
Licensed under the Apache License, Version 2.0 (the "License");
203203
you may not use this file except in compliance with the License.

0 commit comments

Comments
 (0)