Getting 3.x branch ready for 3.4.0 release (#1250)

[cure53]

• build(deps): bump @tootallnate/once and jsdom (build(deps): bump @tootallnate/once and jsdom #1214)

Removes @tootallnate/once. It's no longer used after updating ancestor dependency jsdom. These dependencies need to be updated together.

Removes @tootallnate/once

Updates jsdom from 20.0.3 to 28.1.0

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: "@tootallnate/once" dependency-version: dependency-type: indirect
• dependency-name: jsdom dependency-version: 28.1.0 dependency-type: direct:development ...

• build(deps): bump serialize-javascript and @rollup/plugin-terser (build(deps): bump serialize-javascript and @rollup/plugin-terser #1213)

Bumps serialize-javascript to 7.0.4 and updates ancestor dependency @rollup/plugin-terser. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.2 to 7.0.4

• Release notes
• Commits

Updates @rollup/plugin-terser from 0.4.4 to 1.0.0

• Changelog
• Commits

---

updated-dependencies:

• dependency-name: serialize-javascript dependency-version: 7.0.4 dependency-type: indirect
• dependency-name: "@rollup/plugin-terser" dependency-version: 1.0.0 dependency-type: direct:development ...

• fix: Fixed a problem with the type defition patcher after Node version bump

• build(deps-dev): bump undici from 7.23.0 to 7.24.1 (build(deps-dev): bump undici from 7.23.0 to 7.24.1 #1216)

Bumps undici from 7.23.0 to 7.24.1.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: undici dependency-version: 7.24.1 dependency-type: indirect ...

• build(deps-dev): bump flatted from 3.4.1 to 3.4.2 (build(deps-dev): bump flatted from 3.4.1 to 3.4.2 #1218)

Bumps flatted from 3.4.1 to 3.4.2.

• Commits

---

updated-dependencies:

• dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect ...

• test: Added more browser launchers to stay up-to-date

• test: Testing whether the Browser Stack "latest" labels work

• test: Expanded range of tested Node versions into both directions

• fix: Removed Node 26 test target again, not available yet

• fix: Removed Node 16 test target as it breaks

• Update README.md (Update README.md #1222)

• build(deps-dev): bump serialize-javascript from 7.0.4 to 7.0.5 (build(deps-dev): bump serialize-javascript from 7.0.4 to 7.0.5 #1223)

Bumps serialize-javascript from 7.0.4 to 7.0.5.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: serialize-javascript dependency-version: 7.0.5 dependency-type: indirect ...

• build(deps): bump lodash from 4.17.23 to 4.18.1 (build(deps): bump lodash from 4.17.23 to 4.18.1 #1228)

Bumps lodash from 4.17.23 to 4.18.1.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect ...

• build(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 (build(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 #1225)

Bumps lodash-es from 4.17.23 to 4.18.1.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: lodash-es dependency-version: 4.18.1 dependency-type: indirect ...

• Create scorecard.yml

• fix: FORBID_TAGS must win over ADD_TAGS function predicate (fix: FORBID_TAGS must win over ADD_TAGS function predicate #1230)

Mirrors the FORBID_ATTR early-exit pattern (c361baa, line 1214) for FORBID_TAGS. When EXTRA_ELEMENT_HANDLING.tagCheck is a function that returns true, the short-circuit evaluation previously skipped the FORBID_TAGS check, allowing forbidden elements through.

Moves FORBID_TAGS[tagName] to an OR at the top of the condition so the removal block is always entered for forbidden tags regardless of the tagCheck predicate result.

• Update build-and-test.yml

• [StepSecurity] Apply security best practices ([StepSecurity] Apply security best practices #1231)

• build(deps-dev): bump jsdom from 28.1.0 to 29.0.2 (build(deps-dev): bump jsdom from 28.1.0 to 29.0.2 #1240)

Bumps jsdom from 28.1.0 to 29.0.2.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: jsdom dependency-version: 29.0.2 dependency-type: direct:development update-type: version-update:semver-major ...

• build(deps-dev): bump rollup-plugin-dts from 6.4.0 to 6.4.1 (build(deps-dev): bump rollup-plugin-dts from 6.4.0 to 6.4.1 #1239)

Bumps rollup-plugin-dts from 6.4.0 to 6.4.1.

• Changelog
• Commits

---

updated-dependencies:

• dependency-name: rollup-plugin-dts dependency-version: 6.4.1 dependency-type: direct:development update-type: version-update:semver-patch ...

• build(deps-dev): bump cross-env from 7.0.3 to 10.1.0 (build(deps-dev): bump cross-env from 7.0.3 to 10.1.0 #1238)

Bumps cross-env from 7.0.3 to 10.1.0.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: cross-env dependency-version: 10.1.0 dependency-type: direct:development update-type: version-update:semver-major ...

• build(deps): bump actions/upload-artifact from 4.6.1 to 7.0.1 (build(deps): bump actions/upload-artifact from 4.6.1 to 7.0.1 #1237)

Bumps actions/upload-artifact from 4.6.1 to 7.0.1.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ...

• build(deps-dev): bump @rollup/plugin-node-resolve from 15.3.1 to 16.0.3 (build(deps-dev): bump @rollup/plugin-node-resolve from 15.3.1 to 16.0.3 #1236)

Bumps @rollup/plugin-node-resolve from 15.3.1 to 16.0.3.

• Changelog
• Commits

---

updated-dependencies:

• dependency-name: "@rollup/plugin-node-resolve" dependency-version: 16.0.3 dependency-type: direct:development update-type: version-update:semver-major ...

• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 (build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 #1235)

Bumps ossf/scorecard-action from 2.4.1 to 2.4.3.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch ...

• build(deps): bump actions/checkout from 4.2.2 to 6.0.2 (build(deps): bump actions/checkout from 4.2.2 to 6.0.2 #1234)

Bumps actions/checkout from 4.2.2 to 6.0.2.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ...

• build(deps-dev): bump @babel/preset-env from 7.29.0 to 7.29.2 (build(deps-dev): bump @babel/preset-env from 7.29.0 to 7.29.2 #1233)

Bumps @babel/preset-env from 7.29.0 to 7.29.2.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: "@babel/preset-env" dependency-version: 7.29.2 dependency-type: direct:development update-type: version-update:semver-patch ...

• build(deps): bump github/codeql-action from 3.35.1 to 4.35.1 (build(deps): bump github/codeql-action from 3.35.1 to 4.35.1 #1232)

Bumps github/codeql-action from 3.35.1 to 4.35.1.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ...

• Added CONTRIBUTIONS.md

• chore: Regenerated dist versions

• fix: added osv-scanner.toml to ignore flagged deps

• chore: update build-and-test.yml to get rid of a warning

• docs: update README.md with OSF results

• docs: update build-and-test.yml name

• docs: update README.md badges

• test: removed nine really old browsers from karma tests

• fix: apply SAFE_FOR_TEMPLATES scrub in RETURN_DOM path (fix: apply SAFE_FOR_TEMPLATES scrub in RETURN_DOM path #1241)

The RETURN_DOM path returns before the final template expression scrub, allowing split mustache expressions to reconstruct after element removal. Normalize adjacent text nodes and scrub body before building the return node.

• fix: prevent ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls (fix: prevent ADD_ATTR/ADD_TAGS function leaking into subsequent array… #1242)

When sanitize() is called with ADD_ATTR or ADD_TAGS as a function, the function reference is stored in EXTRA_ELEMENT_HANDLING. A subsequent call that passes ADD_ATTR/ADD_TAGS as an array did not clear the stored function because objectHasOwnProperty(cfg, 'ADD_ATTR') returned true, skipping the conditional reset.

The leaked function is evaluated before URI/tag checks, so a permissive function (returning true) lets dangerous attributes (e.g. javascript: URIs) or forbidden tags (e.g. iframe) through on later calls.

Fix: unconditionally reset tagCheck/attributeCheck to null on every _parseConfig() call, then only set them if the current config provides a function. This ensures no cross-call leakage.

Includes regression tests for both ADD_ATTR and ADD_TAGS leakage scenarios.

• test: reduced number of tested browsers again to be at 24

• Fix mathML attributes (Fix mathML attributes #1243)

• test: reducing BS browser array once more to get unstuck

• test: temporarily reduced browser test array to four main items :-(

• build(deps-dev): bump eslint-config-prettier from 8.10.2 to 10.1.8 (build(deps-dev): bump eslint-config-prettier from 8.10.2 to 10.1.8 #1244)

Bumps eslint-config-prettier from 8.10.2 to 10.1.8.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: eslint-config-prettier dependency-version: 10.1.8 dependency-type: direct:development update-type: version-update:semver-major ...

• build(deps-dev): bump rollup from 3.30.0 to 4.60.1 (build(deps-dev): bump rollup from 3.30.0 to 4.60.1 #1246)

Bumps rollup from 3.30.0 to 4.60.1.

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: rollup dependency-version: 4.60.1 dependency-type: direct:development update-type: version-update:semver-major ...

• build(deps): bump follow-redirects from 1.15.11 to 1.16.0 (build(deps): bump follow-redirects from 1.15.11 to 1.16.0 #1249)

Bumps follow-redirects from 1.15.11 to 1.16.0.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect ...

• test: carefully expanded array of tested BS browsers again

• test: experimenting with new BS config to avoid the freezes
  test: removed two Safari versions as they might be the cause
  docs: updated version numbers for upcoming release

• test: reverted to old BS config values as they worked better

---

Summary

Background & Context

Tasks

• xxxx
• xxxx
• xxxx

Dependencies

• Resolved dependency
• Open dependency