Skip to content

chore: getting 3.x ready for 3.4.1. release - #1299

Closed
cure53 wants to merge 108 commits into
3.xfrom
main
Closed

chore: getting 3.x ready for 3.4.1. release#1299
cure53 wants to merge 108 commits into
3.xfrom
main

Conversation

@cure53

@cure53 cure53 commented Apr 21, 2026

Copy link
Copy Markdown
Owner

See above

dependabot Bot and others added 30 commits March 12, 2026 13:53
@dependabot
build(deps): bump @tootallnate/once and jsdom (#1214)
8207361 
Removes [@tootallnate/once](https://github.com/TooTallNate/once). It's no longer used after updating ancestor dependency [jsdom](https://github.com/jsdom/jsdom). These dependencies need to be updated together.


Removes `@tootallnate/once`

Updates `jsdom` from 20.0.3 to 28.1.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Changelog](https://github.com/jsdom/jsdom/blob/main/Changelog.md)
- [Commits](jsdom/jsdom@20.0.3...28.1.0)

---
updated-dependencies:
- dependency-name: "@tootallnate/once"
  dependency-version: 
  dependency-type: indirect
- dependency-name: jsdom
  dependency-version: 28.1.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump serialize-javascript and @rollup/plugin-terser (#1213)
9d3e5f9 
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.0.4 and updates ancestor dependency [@rollup/plugin-terser](https://github.com/rollup/plugins/tree/HEAD/packages/terser). These dependencies need to be updated together.


Updates `serialize-javascript` from 6.0.2 to 7.0.4
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.0.4)

Updates `@rollup/plugin-terser` from 0.4.4 to 1.0.0
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/terser/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/beep-v1.0.0/packages/terser)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.0.4
  dependency-type: indirect
- dependency-name: "@rollup/plugin-terser"
  dependency-version: 1.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cure53
fix: Fixed a problem with the type defition patcher after Node versio…
fe52ad9 
…n bump
@dependabot
build(deps-dev): bump undici from 7.23.0 to 7.24.1 (#1216)
baed9eb 
Bumps [undici](https://github.com/nodejs/undici) from 7.23.0 to 7.24.1.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.23.0...v7.24.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.24.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps-dev): bump flatted from 3.4.1 to 3.4.2 (#1218)
72ec979 
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.4.1 to 3.4.2.
- [Commits](WebReflection/flatted@v3.4.1...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cure53
test: Added more browser launchers to stay up-to-date
266bc0a
@cure53
Merge branch 'main' of github.com:cure53/DOMPurify
41239e8
@cure53
test: Testing whether the Browser Stack "latest" labels work
f308f73
@cure53
test: Expanded range of tested Node versions into both directions
61b7cb5
@cure53
fix: Removed Node 26 test target again, not available yet
951499e
@cure53
fix: Removed Node 16 test target as it breaks
aa1529f
@cure53
Update README.md (#1222)
c48cf5f
@dependabot
build(deps-dev): bump serialize-javascript from 7.0.4 to 7.0.5 (#1223)
883ac15 
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) from 7.0.4 to 7.0.5.
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v7.0.4...v7.0.5)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.0.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump lodash from 4.17.23 to 4.18.1 (#1228)
d20f7f4 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 (#1225)
4c10ed3 
Bumps [lodash-es](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash-es
  dependency-version: 4.18.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cure53
Create scorecard.yml
c083064
@kodareef5
fix: FORBID_TAGS must win over ADD_TAGS function predicate (#1230)
f0ac588 
Mirrors the FORBID_ATTR early-exit pattern (c361baa, line 1214) for
FORBID_TAGS. When EXTRA_ELEMENT_HANDLING.tagCheck is a function that
returns true, the short-circuit evaluation previously skipped the
FORBID_TAGS check, allowing forbidden elements through.

Moves FORBID_TAGS[tagName] to an OR at the top of the condition so the
removal block is always entered for forbidden tags regardless of the
tagCheck predicate result.
@cure53
Update build-and-test.yml
29251e6
@step-security-bot
[StepSecurity] Apply security best practices (#1231)
4968a9a 
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
@dependabot
build(deps-dev): bump jsdom from 28.1.0 to 29.0.2 (#1240)
b6686dc 
Bumps [jsdom](https://github.com/jsdom/jsdom) from 28.1.0 to 29.0.2.
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v28.1.0...v29.0.2)

---
updated-dependencies:
- dependency-name: jsdom
  dependency-version: 29.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps-dev): bump rollup-plugin-dts from 6.4.0 to 6.4.1 (#1239)
fa36a23 
Bumps [rollup-plugin-dts](https://github.com/Swatinem/rollup-plugin-dts) from 6.4.0 to 6.4.1.
- [Changelog](https://github.com/Swatinem/rollup-plugin-dts/blob/master/CHANGELOG.md)
- [Commits](Swatinem/rollup-plugin-dts@v6.4.0...v6.4.1)

---
updated-dependencies:
- dependency-name: rollup-plugin-dts
  dependency-version: 6.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps-dev): bump cross-env from 7.0.3 to 10.1.0 (#1238)
894c11d 
Bumps [cross-env](https://github.com/kentcdodds/cross-env) from 7.0.3 to 10.1.0.
- [Release notes](https://github.com/kentcdodds/cross-env/releases)
- [Changelog](https://github.com/kentcdodds/cross-env/blob/main/CHANGELOG.md)
- [Commits](kentcdodds/cross-env@v7.0.3...v10.1.0)

---
updated-dependencies:
- dependency-name: cross-env
  dependency-version: 10.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump actions/upload-artifact from 4.6.1 to 7.0.1 (#1237)
be68671 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.1 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@4cec3d8...043fb46)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps-dev): bump @rollup/plugin-node-resolve from 15.3.1 to 16.0…
c37fc3b 
….3 (#1236)

Bumps [@rollup/plugin-node-resolve](https://github.com/rollup/plugins/tree/HEAD/packages/node-resolve) from 15.3.1 to 16.0.3.
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/node-resolve/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/node-resolve-v16.0.3/packages/node-resolve)

---
updated-dependencies:
- dependency-name: "@rollup/plugin-node-resolve"
  dependency-version: 16.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 (#1235)
4fe8735 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.1 to 2.4.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@f49aabe...4eaacf0)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump actions/checkout from 4.2.2 to 6.0.2 (#1234)
c50ff9d 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.2.2...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps-dev): bump @babel/preset-env from 7.29.0 to 7.29.2 (#1233)
ad0f9a9 
Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.29.0 to 7.29.2.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-preset-env)

---
updated-dependencies:
- dependency-name: "@babel/preset-env"
  dependency-version: 7.29.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github/codeql-action from 3.35.1 to 4.35.1 (#1232)
f611c2e 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3.35.1...c10b806)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cure53
Added CONTRIBUTIONS.md
7e48fd3
@cure53
chore: Regenerated dist versions
449b81d
cure53 and others added 28 commits April 16, 2026 23:39
@cure53
Merge branch 'main' into cure53-test-suite
bd23ddf
@cure53
Merge pull request #1275 from cure53/cure53-test-suite
1eafa0b 
fix: added pinning hash for dependency
@cure53
Update README.md
43889ee 
Updated browser test coverage info
@cure53
Merge pull request #1276 from cure53/cure53-update-readme-1
c085adf 
Update README.md
@cure53
build: migrate rollup-plugin-typescript2 and pre-commit
84eaf22 
Switch rollup-plugin-typescript2 → @rollup/plugin-typescript (official,
actively maintained by the Rollup team). Type declaration pipeline is
unaffected — types are generated by tsc directly, not the rollup plugin.

Switch pre-commit → husky (modern standard, zero runtime deps, actively
maintained). Hook behavior is identical: lint + build + stage dist files.
The prepare script ensures hooks install automatically on npm install.
@cure53
Merge pull request #1277 from cure53/cure53-build-tooling
3109315 
build: migrate rollup-plugin-typescript2 and pre-commit
@cure53
chore: cleaned up two ignored issues from OSV TOML file
c471e07
@x00mario
Merge branch 'main' into cure53-build-tooling
b42d379
@cure53
Merge pull request #1278 from cure53/cure53-build-tooling
0a02c13 
chore: cleaned up two ignored issues from OSV TOML file
@cure53
chore: removed some unneeded files
4684853 
build: made sure npx is properly pinned and not flagged by scorecard
@x00mario
Merge branch 'main' into cure53-build-tooling
3094d38
@cure53 @x00mario
chore: removed some unneeded files (#1279)
ca55678 
build: made sure npx is properly pinned and not flagged by scorecard

Co-authored-by: Mario Heiderich <mario.heiderich@gmail.com>
@cure53
Create CODEOWNERS (#1280)
9269774
@cure53
Merge branch 'main' into cure53-build-tooling
21a3abe
@cure53 @x00mario
chore: removed some unneeded files (#1281)
d50584f 
build: made sure npx is properly pinned and not flagged by scorecard

Co-authored-by: Mario Heiderich <mario.heiderich@gmail.com>
@cure53
Update build-and-test.yml (#1282)
12253f8
@dependabot
build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#1288)
9b36c07 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c10b806...95e58e9)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @cure53
build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 (#1286)
d7d96eb 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4.6.2...043fb46)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Cure53 <mario@cure53.de>
@dependabot @cure53
build(deps): bump step-security/harden-runner from 2.17.0 to 2.18.0 (#…
d648f00 
…1285)

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.17.0 to 2.18.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@f808768...6c3c2f2)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Cure53 <mario@cure53.de>
@dependabot @cure53
build(deps-dev): bump fast-check from 4.6.0 to 4.7.0 (#1287)
640df73 
Bumps [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) from 4.6.0 to 4.7.0.
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.7.0/packages/fast-check)

---
updated-dependencies:
- dependency-name: fast-check
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Cure53 <mario@cure53.de>
@cure53
Update purify.ts (#1290)
c99fcac 
chore: removed some risky dead code, thanks @1Jesper1
@cure53
Update config.ts (#1291)
c64909c 
chore: fixed a typo, thanks @1Jesper1
@cure53
Update README.md (#1292)
9bab128
@dependabot
build(deps-dev): bump rollup from 4.60.1 to 4.60.2 (#1294)
c775242 
Bumps [rollup](https://github.com/rollup/rollup) from 4.60.1 to 4.60.2.
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.60.1...v4.60.2)

---
updated-dependencies:
- dependency-name: rollup
  dependency-version: 4.60.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cure53
Update attrs.ts (#1295)
96dc5bc 
fix: removed a duplicate entry
@cure53
Cure53 code hardening (#1296)
d22a019 
* chore: added stronger check for HTML Custom Element tagnames
cxhore: added stronger check for IN_PLACE tagname types

* test: add regression and pinning tests from April 2026 review
@cure53
test: added more fuzzer properties and a negative check (#1297)
7474d38
@cure53
Cure53 fuzzer update (#1298)
75a62f1 
* test: added more fuzzer properties and a negative check
* chore: getting ready for 3.4.1 release
@github-advanced-security

github-advanced-security AI commented Apr 21, 2026

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@cure53 cure53 closed this Apr 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@cure53 @github-advanced-security @kodareef5 @step-security-bot @bencalif @1Jesper1 @DavidOliver @x00mario