Skip to content

Bump dompurify, @itwin/appui-react, @itwin/components-react, @itwin/core-react and @itwin/imodel-components-react#87

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-55aeeeb892
Open

Bump dompurify, @itwin/appui-react, @itwin/components-react, @itwin/core-react and @itwin/imodel-components-react#87
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-55aeeeb892

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 29, 2025 •
edited
Loading

Bumps dompurify to 3.2.5 and updates ancestor dependencies dompurify, @itwin/appui-react, @itwin/components-react, @itwin/core-react and @itwin/imodel-components-react. These dependencies need to be updated together.

Updates dompurify from 2.5.7 to 3.2.5

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year

DOMPurify 3.2.3

DOMPurify 3.2.2

  • Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @​yaniv-git
  • Fixed several minor issues with the type definitions, thanks again @​reduckted
  • Fixed a minor issue with the types reference for trusted types, thanks @​reduckted
  • Fixed a minor problem with the template detection regex on some systems, thanks @​svdb99

DOMPurify 3.2.1

DOMPurify 3.2.0

DOMPurify 3.1.7

  • Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @​masatokinugawa
  • Fixed several smaller typos in documentation and test & build files, thanks @​christianhg
  • Added better support for Angular compiler, thanks @​jeroen1602
  • Added several new attributes to HTML and SVG allow-list, thanks @​Gigabyte5671 and @​Rotzbua
  • Removed the foreignObject element from the list of HTML entry-points, thanks @​masatokinugawa
  • Bumped several dependencies to be more up to date

DOMPurify 3.1.6

  • Fixed an issue with the execution logic of attribute hooks to prevent bypasses, thanks @​kevin-mizu
  • Fixed an issue with element removal leading to uncaught errors through DOM Clobbering, thanks @​realansgar
  • Fixed a minor problem with the bower file pointing to the wrong dist path
  • Fixed several minor typos in docs, comments and comment blocks, thanks @​Rotzbua
  • Updated several development dependencies

... (truncated)

Commits
  • 7806004 Merge pull request #1082 from cure53/main
  • f14c22f chore: Preparing 3.2.5 release
  • c69d7a8 Merge pull request #1080 from hhk-png/main
  • fce40b5 chore: for lint
  • 59e8664 Merge branch 'cure53:main' into main
  • e62e3ef fix: Using ALLOWED_URI_REGEXP with the 'g' flag leads to incorrect results
  • b428788 Update README.md
  • 72c00db Merge branch 'main' of github.com:cure53/DOMPurify
  • 49882dc test: Added Node 23.x to tested runtimes, removed Node 17.x
  • 2e5fd64 Merge pull request #1078 from reduckted/fix-sourcemaps
  • Additional commits viewable in compare view

Updates @itwin/appui-react from 4.17.1 to 5.4.0

Release notes

Sourced from @​itwin/appui-react's releases.

v5.4.0

5.4.0 Change Notes

Table of contents:

@​itwin/appui-react

Deprecations

  • Deprecated iconRight property of CursorMenuItemProps interface. Consumers should use newly added iconRightNode instead. #1265

    // Before
const item: CursorMenuItemProps = {
  iconRight: "icon-placeholder",
};
// After
const item: CursorMenuItemProps = {
iconRightNode: <SvgPlaceholder />,
};

Additions

  • Added iconRightNode property to CursorMenuItemProps which replaces deprecated web font icon specific iconRight property. #1265

  • Added visibleToolSettings prop to StandardLayout component which when enabled keeps the tool settings visible to the end user. This is especially useful when the tool settings is undocked as a regular widget as changing a tool or it's tool settings will show the tool settings widget via the WidgetDef.show() API. #1266

    UiFramework.frontstages.addFrontstage({
  // ...
  layout: <StandardLayout visibleToolSettings />,
});

  • Added cursorDocument getter to CursorInformation class. Added targetDocument optional argument to updatePosition, update and open methods of CursorPopupManager class. Added targetDocument property to CursorPopupInfo interface. These additions are used to support cursor based functionality in child windows and popout widgets by specifying a window document. #1277

  • Added handleContentMouseLeave property to FrameworkVisibility interface available via UiFramework.visibility. This new method together with existing handleContentMouseMove allows consumers to mark when cursor is interacting with the main content of the application - usually a viewport. These APIs are currently used by UI auto hide feature and promptAtContent feature of ToolAssistanceField component. #1277

    By default content mouse events are handled by:

... (truncated)

Changelog

Sourced from @​itwin/appui-react's changelog.

5.4.0

Thu, 17 Apr 2025 09:55:41 GMT

Updates

  • Fixed iconNode property rendering of CursorMenuItemProps interface in CursorPopupMenu component.
  • Add DefaultFrameworkFrontstages class.
  • Add toolSettings.defaultLocation to StandardLayout component.
  • Display prompt at cursor in child windows.
  • Simplify grid template definitions of standard layout to avoid CSS issues in RsBuild production build.
  • Changed ToolAssistanceField from class to functional component.
  • Added visibleToolSettings prop to StandardLayout component.

5.3.1

Thu, 20 Mar 2025 11:10:28 GMT

Updates

  • Remove redundant spacing between toolbars when the app button or navigation aid is not displayed.
  • Fix Firefox specific style loading issue of widget popouts.

5.3.0

Fri, 14 Mar 2025 17:37:48 GMT

Updates

  • Add layout prop to Frontstage interface.
  • Add additional methods to UiItemsManager that return items for custom layouts.
  • Add widgetActions prop to StandardLayout component.

5.2.0

Thu, 27 Feb 2025 08:07:36 GMT

Updates

  • Remove @​itwin/core-telemetry from @​itwin/appui-react devDependencies
  • Add promptAtContent prop to ToolAssistanceField component.
  • Add useSavedState to Widget interface.

5.1.0

Thu, 30 Jan 2025 09:15:23 GMT

Updates

  • Remove @​itwin/core-telemetry from @​itwin/appui-react peerDependencies
  • Added customizable node for empty tool settings.
  • cSpell fixes
  • Fixed some AccuDraw behaviors that where working incorrectly, like input highlight, focus and update. Improved typing Bearing angles.

5.0.5

... (truncated)

Commits

Updates @itwin/components-react from 4.17.1 to 5.4.0

Release notes

Sourced from @​itwin/components-react's releases.

v5.4.0

5.4.0 Change Notes

Table of contents:

@​itwin/appui-react

Deprecations

  • Deprecated iconRight property of CursorMenuItemProps interface. Consumers should use newly added iconRightNode instead. #1265

    // Before
const item: CursorMenuItemProps = {
  iconRight: "icon-placeholder",
};
// After
const item: CursorMenuItemProps = {
iconRightNode: <SvgPlaceholder />,
};

Additions

  • Added iconRightNode property to CursorMenuItemProps which replaces deprecated web font icon specific iconRight property. #1265

  • Added visibleToolSettings prop to StandardLayout component which when enabled keeps the tool settings visible to the end user. This is especially useful when the tool settings is undocked as a regular widget as changing a tool or it's tool settings will show the tool settings widget via the WidgetDef.show() API. #1266

    UiFramework.frontstages.addFrontstage({
  // ...
  layout: <StandardLayout visibleToolSettings />,
});

  • Added cursorDocument getter to CursorInformation class. Added targetDocument optional argument to updatePosition, update and open methods of CursorPopupManager class. Added targetDocument property to CursorPopupInfo interface. These additions are used to support cursor based functionality in child windows and popout widgets by specifying a window document. #1277

  • Added handleContentMouseLeave property to FrameworkVisibility interface available via UiFramework.visibility. This new method together with existing handleContentMouseMove allows consumers to mark when cursor is interacting with the main content of the application - usually a viewport. These APIs are currently used by UI auto hide feature and promptAtContent feature of ToolAssistanceField component. #1277

    By default content mouse events are handled by:

... (truncated)

Changelog

Sourced from @​itwin/components-react's changelog.

5.4.0

Thu, 17 Apr 2025 09:55:41 GMT

Updates

  • useCommittableValue: Avoid invoking commit if value is the same as the initial.
  • Added new system for rendering property value editor components.

5.3.1

Thu, 20 Mar 2025 11:10:28 GMT

Version update only

5.3.0

Fri, 14 Mar 2025 17:37:48 GMT

Version update only

5.2.0

Thu, 27 Feb 2025 08:07:36 GMT

Updates

  • Fix an issue which prevented tabbing through editor containers.

5.1.0

Thu, 30 Jan 2025 09:15:23 GMT

Updates

  • cSpell fixes

5.0.5

Tue, 21 Jan 2025 11:38:58 GMT

Version update only

5.0.4

Fri, 17 Jan 2025 14:12:03 GMT

Updates

  • Fixed module 'lodash' does not provide an export named... error when running in Node.js.

5.0.3

Fri, 17 Jan 2025 11:42:02 GMT

Version update only

5.0.2

... (truncated)

Commits

Updates @itwin/core-react from 4.17.1 to 5.4.0

Release notes

Sourced from @​itwin/core-react's releases.

v5.4.0

5.4.0 Change Notes

Table of contents:

@​itwin/appui-react

Deprecations

  • Deprecated iconRight property of CursorMenuItemProps interface. Consumers should use newly added iconRightNode instead. #1265

    // Before
const item: CursorMenuItemProps = {
  iconRight: "icon-placeholder",
};
// After
const item: CursorMenuItemProps = {
iconRightNode: <SvgPlaceholder />,
};

Additions

  • Added iconRightNode property to CursorMenuItemProps which replaces deprecated web font icon specific iconRight property. #1265

  • Added visibleToolSettings prop to StandardLayout component which when enabled keeps the tool settings visible to the end user. This is especially useful when the tool settings is undocked as a regular widget as changing a tool or it's tool settings will show the tool settings widget via the WidgetDef.show() API. #1266

    UiFramework.frontstages.addFrontstage({
  // ...
  layout: <StandardLayout visibleToolSettings />,
});

  • Added cursorDocument getter to CursorInformation class. Added targetDocument optional argument to updatePosition, update and open methods of CursorPopupManager class. Added targetDocument property to CursorPopupInfo interface. These additions are used to support cursor based functionality in child windows and popout widgets by specifying a window document. #1277

  • Added handleContentMouseLeave property to FrameworkVisibility interface available via UiFramework.visibility. This new method together with existing handleContentMouseMove allows consumers to mark when cursor is interacting with the main content of the application - usually a viewport. These APIs are currently used by UI auto hide feature and promptAtContent feature of ToolAssistanceField component. #1277

    By default content mouse events are handled by:

... (truncated)

Changelog

Sourced from @​itwin/core-react's changelog.

5.4.0

Thu, 17 Apr 2025 09:55:41 GMT

Version update only

5.3.1

Thu, 20 Mar 2025 11:10:28 GMT

Updates

  • Fixed web font icon sizes in IconComponent

5.3.0

Fri, 14 Mar 2025 17:37:48 GMT

Version update only

5.2.0

Thu, 27 Feb 2025 08:07:36 GMT

Updates

  • Update dompurify dependency version.

5.1.0

Thu, 30 Jan 2025 09:15:23 GMT

Updates

  • cSpell fixes

5.0.5

Tue, 21 Jan 2025 11:38:58 GMT

Version update only

5.0.4

Fri, 17 Jan 2025 14:12:03 GMT

Updates

  • Fixed module 'lodash' does not provide an export named... error when running in Node.js.

5.0.3

Fri, 17 Jan 2025 11:42:02 GMT

Version update only

5.0.2

Thu, 16 Jan 2025 12:04:12 GMT

... (truncated)

Commits

Updates @itwin/imodel-components-react from 4.17.1 to 5.4.0

Release notes

Sourced from @​itwin/imodel-components-react's releases.

v5.4.0

5.4.0 Change Notes

Table of contents:

@​itwin/appui-react

Deprecations

  • Deprecated iconRight property of CursorMenuItemProps interface. Consumers should use newly added iconRightNode instead. #1265

    // Before
const item: CursorMenuItemProps = {
  iconRight: "icon-placeholder",
};
// After
const item: CursorMenuItemProps = {
iconRightNode: <SvgPlaceholder />,
};

Additions

  • Added iconRightNode property to CursorMenuItemProps which replaces deprecated web font icon specific iconRight property. #1265

  • Added visibleToolSettings prop to StandardLayout component which when enabled keeps the tool settings visible to the end user. This is especially useful when the tool settings is undocked as a regular widget as changing a tool or it's tool settings will show the tool settings widget via the WidgetDef.show() API. #1266

    UiFramework.frontstages.addFrontstage({
  // ...
  layout: <StandardLayout visibleToolSettings />,
});

  • Added cursorDocument getter to CursorInformation class. Added targetDocument optional argument to updatePosition, update and open methods of CursorPopupManager class. Added targetDocument property to CursorPopupInfo interface. These additions are used to support cursor based functionality in child windows and popout widgets by specifying a window document. #1277

  • Added handleContentMouseLeave property to FrameworkVisibility interface available via UiFramework.visibility. This new method together with existing handleContentMouseMove allows consumers to mark when cursor is interacting with the main content of the application - usually a viewport. These APIs are currently used by UI auto hide feature and promptAtContent feature of ToolAssistanceField component. #1277

    By default content mouse events are handled by:

... (truncated)

Changelog

Sourced from @​itwin/imodel-components-react's changelog.

5.4.0

Thu, 17 Apr 2025 09:55:41 GMT

Updates

  • Added Quantity and Weight property editor specifications for the new editors system.

5.3.1

Thu, 20 Mar 2025 11:10:28 GMT

Version update only

5.3.0

Fri, 14 Mar 2025 17:37:48 GMT

Version update only

5.2.0

Thu, 27 Feb 2025 08:07:36 GMT

Version update only

5.1.0

Thu, 30 Jan 2025 09:15:23 GMT

Updates

  • cSpell fixes

5.0.5

Tue, 21 Jan 2025 11:38:58 GMT

Version update only

5.0.4

Fri, 17 Jan 2025 14:12:03 GMT

Version update only

5.0.3

Fri, 17 Jan 2025 11:42:02 GMT

Version update only

5.0.2

Thu, 16 Jan 2025 12:04:12 GMT

Updates

  • Use import attributes for json imports.

... (truncated)

Commits

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump dompurify, @itwin/appui-react, @itwin/components-react, @itwin/c…
52fd1f6 
…ore-react and @itwin/imodel-components-react

Bumps [dompurify](https://github.com/cure53/DOMPurify) to 3.2.5 and updates ancestor dependencies [dompurify](https://github.com/cure53/DOMPurify), [@itwin/appui-react](https://github.com/iTwin/appui/tree/HEAD/ui/appui-react), [@itwin/components-react](https://github.com/iTwin/appui/tree/HEAD/ui/components-react), [@itwin/core-react](https://github.com/iTwin/appui/tree/HEAD/ui/core-react) and [@itwin/imodel-components-react](https://github.com/iTwin/appui/tree/HEAD/ui/imodel-components-react). These dependencies need to be updated together.


Updates `dompurify` from 2.5.7 to 3.2.5
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@2.5.7...3.2.5)

Updates `@itwin/appui-react` from 4.17.1 to 5.4.0
- [Release notes](https://github.com/iTwin/appui/releases)
- [Changelog](https://github.com/iTwin/appui/blob/release/5.4.0/ui/appui-react/CHANGELOG.md)
- [Commits](https://github.com/iTwin/appui/commits/release/5.4.0/ui/appui-react)

Updates `@itwin/components-react` from 4.17.1 to 5.4.0
- [Release notes](https://github.com/iTwin/appui/releases)
- [Changelog](https://github.com/iTwin/appui/blob/release/5.4.0/ui/components-react/CHANGELOG.md)
- [Commits](https://github.com/iTwin/appui/commits/release/5.4.0/ui/components-react)

Updates `@itwin/core-react` from 4.17.1 to 5.4.0
- [Release notes](https://github.com/iTwin/appui/releases)
- [Changelog](https://github.com/iTwin/appui/blob/release/5.4.0/ui/core-react/CHANGELOG.md)
- [Commits](https://github.com/iTwin/appui/commits/release/5.4.0/ui/core-react)

Updates `@itwin/imodel-components-react` from 4.17.1 to 5.4.0
- [Release notes](https://github.com/iTwin/appui/releases)
- [Changelog](https://github.com/iTwin/appui/blob/release/5.4.0/ui/imodel-components-react/CHANGELOG.md)
- [Commits](https://github.com/iTwin/appui/commits/release/5.4.0/ui/imodel-components-react)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.2.5
  dependency-type: indirect
- dependency-name: "@itwin/appui-react"
  dependency-version: 5.4.0
  dependency-type: direct:production
- dependency-name: "@itwin/components-react"
  dependency-version: 5.4.0
  dependency-type: direct:production
- dependency-name: "@itwin/core-react"
  dependency-version: 5.4.0
  dependency-type: direct:production
- dependency-name: "@itwin/imodel-components-react"
  dependency-version: 5.4.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Apr 29, 2025
@dependabot dependabot bot requested a review from a team as a code owner April 29, 2025 15:34
@dependabot dependabot bot added the javascript Pull requests that update javascript code label Apr 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants