Skip to content

Bump dompurify and @umbraco-cms/backoffice in /src/Umbraco.Ai.Web.StaticAssets/Client#1

Closed
dependabot[bot] wants to merge 258 commits into
mainfrom
dependabot/npm_and_yarn/src/Umbraco.Ai.Web.StaticAssets/Client/multi-8f1d4ca600
Closed

Bump dompurify and @umbraco-cms/backoffice in /src/Umbraco.Ai.Web.StaticAssets/Client#1
dependabot[bot] wants to merge 258 commits into
mainfrom
dependabot/npm_and_yarn/src/Umbraco.Ai.Web.StaticAssets/Client/multi-8f1d4ca600

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jan 9, 2026

Copy link
Copy Markdown
Contributor

Bumps dompurify to 3.3.1 and updates ancestor dependency @umbraco-cms/backoffice. These dependencies need to be updated together.

Updates dompurify from 3.1.7 to 3.3.1

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.1

  • Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @​MariusRumpf
  • Updated the ESM import syntax to be more correct, thanks @​binhpv

DOMPurify 3.3.0

  • Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
  • Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
  • Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren

DOMPurify 3.2.7

  • Added new attributes and elements to default allow-list, thanks @​elrion018
  • Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
  • Added better check for animated href attributes, thanks @​llamakko
  • Updated and improved the bundled types, thanks @​ssi02014
  • Updated several tests to better align with new browser encoding behaviors
  • Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
  • Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

DOMPurify 3.2.6

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year

DOMPurify 3.2.3

DOMPurify 3.2.2

... (truncated)

Commits
  • 6fc446a Merge pull request #1175 from cure53/main
  • 3b3bf91 Merge branch 'main' of github.com:cure53/DOMPurify
  • 9863f41 chore: Preparing 3.3.1 release
  • b4e0295 chore: Preparing 3.3.0 release
  • 077746b build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1170)
  • 4de68bb build(deps): bump actions/checkout from 5 to 6 (#1171)
  • 4c76b6f Use correct ESM import syntax (#1173)
  • 27e8496 Merge pull request #1168 from MariusRumpf/add-forbid-contents
  • a920096 Add ADD_FORBID_CONTENTS setting to extend default list
  • ac64660 Merge pull request #1163 from cure53/dependabot/github_actions/actions/setup-...
  • Additional commits viewable in compare view

Updates @umbraco-cms/backoffice from 17.0.2 to 17.1.0

Release notes

Sourced from @​umbraco-cms/backoffice's releases.

17.1.0

What's Changed Since 17.1.0-rc

🐛 Bug Fixes

Full Changelog: umbraco/Umbraco-CMS@release-17.1.0-rc...release-17.1.0

What's Changed Since the Last Release (17.0.2)

📦 Dependencies

🌈 Accessibility Improvements

🚀 New Features

... (truncated)

Commits
  • 2832436 Fix login validation messages not showing on submit (#21306)
  • 462d63b Media: Fix files not deleted from disk when recycle bin protection is enabled...
  • 2173615 Hotfix: refactor of #21221 (#21293)
  • 4e2fdfc Bumped version to 17.1.0.
  • 18fafaa Content: Fix property variation change breaking document save via Infinite Ed...
  • 2d35e32 HybridCache: Clear published content cache on content type change (#21225)
  • 72e85ec TextBox: Fix max length validation message showing wrong exceeded count (#21219)
  • 296102c Content Type Workspace: Fix navigation blocked after save (#21218)
  • c9dcaa8 Document Permissions: Export UmbDocumentUserPermissionCondition from package ...
  • 4aa5061 Indexing: Gracefully handle element property variance changes at index time (...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

mattbrailsford and others added 30 commits November 24, 2025 20:08
Convert provider registration to use Umbraco's collection builder pattern
for consistency with middleware and better extensibility.

Changes:
- Add IDiscoverable marker to IAiProvider interface
- Create AiProviderCollection with GetById() and GetWithCapability<T>() helpers
- Create AiProviderCollectionBuilder extending LazyCollectionBuilderBase
- Add AiProviders() extension method on IUmbracoBuilder
- Replace manual assembly scanning with TypeLoader auto-discovery
- Update AiRegistry to inject AiProviderCollection
- Remove IAiComponent interface (members moved to IAiProvider)

Usage:
  builder.AiProviders()
      .Add<CustomProvider>()
      .Exclude<SomeUnwantedProvider>();

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Add comprehensive implementation plan for Umbraco.Ai v1 covering:
- Phase 0: Provider collection builder (completed)
- Phase 1: Middleware collection builder
- Phase 2: IAiEmbeddingService implementation
- Phase 3: Management API endpoints
- Phase 4: EF Core database persistence
- Phase 5: Frontend UI implementation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Convert middleware registration to use Umbraco's OrderedCollectionBuilder
pattern for explicit ordering control with InsertBefore/InsertAfter methods.

Changes:
- Add AiChatMiddlewareCollection and AiChatMiddlewareCollectionBuilder
- Add AiEmbeddingMiddlewareCollection and AiEmbeddingMiddlewareCollectionBuilder
- Add AiChatMiddleware() and AiEmbeddingMiddleware() extension methods
- Remove Order property from IAiChatMiddleware and IAiEmbeddingMiddleware
- Update factories to inject collection types instead of IEnumerable
- Delete AiMiddlewareExtensions.cs (replaced by collection builders)
- Update documentation in CLAUDE.md and core-implementation-details.md

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
- Add test package dependencies to Directory.Packages.props
  (xUnit, FluentAssertions, Moq, coverlet, Verify.Xunit)
- Fix NuGet.config packageSourceMapping structure
- Add test projects to solution:
  - Umbraco.Ai.Tests.Common: Shared builders and fakes
  - Umbraco.Ai.Core.Tests: Core unit tests
  - Umbraco.Ai.Web.Tests: Web/API tests (placeholder)
- Add InternalsVisibleTo for test assemblies in Core project
- Add GitHub Actions workflow for automated testing
- Implement 15 unit tests for AiSettingsResolver covering:
  - Null settings handling
  - Typed settings pass-through
  - Configuration variable resolution ($ConfigKey syntax)
  - JsonElement deserialization
  - Anonymous object fallback
  - Required field validation
  - Unknown provider error handling

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Implement comprehensive unit tests for all critical path services:
- AiChatClientFactory: client creation, validation, middleware application
- AiProfileService: profile retrieval, default profile resolution
- AiConnectionService: CRUD operations, validation, connection testing
- AiRegistry: provider lookup (case-insensitive), capability filtering
- AiChatService: chat completions, streaming, options merging
- Middleware pipeline: ordering, wrapping, empty collection handling
- Provider base classes: attributes, capabilities, settings type

Total: 82 new tests (104 total including Phase 1)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
- Add Umbraco.Ai.Tests.Integration project with:
  - ServiceResolutionTests: DI smoke tests for critical service graph
  - EndToEndServiceFlowTests: Full pipeline tests with fake providers
- Rename test projects to follow consistent naming:
  - Umbraco.Ai.Tests.Unit (was Umbraco.Ai.Core.Tests)
  - Umbraco.Ai.Tests.Integration
  - Umbraco.Ai.Tests.Common
  - Remove empty Umbraco.Ai.Web.Tests project
- Add shared test infrastructure (aligned with Umbraco CMS):
  - tests/Directory.Build.props (IsPackable, TreatWarningsAsErrors)
  - tests/Directory.Packages.props (multi-level merging)
- Update InternalsVisibleTo for new test project names
- Total: 126 tests (104 unit, 22 integration)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This reverts commit 790d6dd.
mattbrailsford and others added 22 commits January 8, 2026 10:16
Refactor the Settings infrastructure to be more generic, allowing it to work
with both provider settings and context resource data models.

Core type renames:
- AiSettingAttribute → AiEditableModelFieldAttribute (+ AiFieldAttribute alias)
- AiSettingDefinition → AiEditableModelField
- IAiSettingDefinitionBuilder → IAiEditableModelSchemaBuilder
- AiSettingDefinitionBuilder → AiEditableModelSchemaBuilder
- IAiSettingsResolver → IAiEditableModelResolver
- AiSettingsResolver → AiEditableModelResolver

New types:
- AiEditableModelSchema: Wraps model type and field collection
- AiEditableModelResolverExtensions: Convenience methods for resolution
- EditableModelSchemaModel: API response model for schema
- JsonStringTypeConverter: JSON serialization helper

Interface changes:
- IAiProvider.GetSettingDefinitions() → GetSettingsSchema() (returns AiEditableModelSchema?)
- IAiProviderInfrastructure.SettingDefinitionBuilder → SchemaBuilder
- IAiEditableModelResolver.ResolveSettings<T>() → ResolveModel<T>()

Folder rename: Settings/ → EditableModels/

Also includes:
- Shared type-mapper and types in frontend core module
- Common mapping definitions for editable model schemas
- Updated API client types

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update ByIdProviderControllerTests to use new SettingsSchema property
with EditableModelSchemaModel type. Update AiConnectionServiceTests to
mock ResolveModel<T> instead of the unmockable extension method
ResolveSettingsForProvider.

🤖 Generated with [Claude Code](https://claude.ai/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Extract model editor functionality from connection details view into a
reusable component that renders dynamic forms based on editable model
schemas. Also fixes UaiEditableModelSchemaModel naming typo.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Change resource Data from string to object throughout the stack
- Add DataSchema to ContextResourceTypeResponseModel for dynamic UI forms
- Use IAiEditableModelResolver for type-safe model resolution
- Simplify resource-list.element.ts (schema now on item model)
- Add Swagger MapType<Type> for string serialization
- Add localization entries for Text and BrandVoice resource fields

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
When creating a new resource, the options modal now opens on top of
the picker. Cancelling the options modal returns to the picker instead
of closing everything.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Changed from @click to @OPEN event which is the correct event for
uui-card-content-node components to trigger the edit modal.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Moved injection mode from tag badge to card description for cleaner UI.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add Constants.DefaultJsonSerializerOptions with camelCase and converters
- Add EditorConfig property to AiEditableModelFieldAttribute
- Parse EditorConfig JSON in AiEditableModelSchemaBuilder
- Update BrandVoice fields to use TextArea with row configuration
- Refactor all JSON serialization to use centralized options
- Remove size attribute from injection mode tag

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use MarkdownEditor for Text resource content
- Add rows configuration to all BrandVoice TextArea fields
- Fix injection mode select to show correct selection state
- Fix model-editor to handle array config format

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Implements a property editor for assigning AI contexts to content nodes:

Frontend:
- uai-context-picker: Reusable picker component with add/remove
- Property editor UI wrapper with single/multiple selection support
- Reuses existing item-picker modal for context selection
- Localization strings for picker UI

Backend:
- AiContextPropertyValueConverter: Returns AiContext or IEnumerable<AiContext>
- PropertyEditors.Aliases.ContextPicker constant

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The context injection middleware is now automatically registered in the
chat middleware pipeline. Updated documentation to reflect this change.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…ile contexts

- Update UaiItemPickerModalElement to support multiple selection mode with
  checkbox-based selection, toggle behavior, and confirm button
- Change modal return type to UaiItemPickerModalValue with selection array
- Add select-only attribute to prevent double halo on selectable items
- Update context picker to handle new array-based selection result
- Move ContextIds from AiProfile to AiChatProfileSettings
- Update profile workspace view with context picker
- Update migrations and mappings for context association changes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add proper server-side implementation for the AI Context Picker property editor:
- Add AiContextPickerConfiguration with multiple, min, max settings
- Add AiContextPickerConfigurationEditor to expose configuration fields
- Wire up CreateConfigurationEditor in the DataEditor
- Remove [DefaultPropertyValueConverter] to fix converter conflict
- Change frontend config from Number to Integer property editor UI

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Bumps [dompurify](https://github.com/cure53/DOMPurify) to 3.3.1 and updates ancestor dependency [@umbraco-cms/backoffice](https://github.com/umbraco/Umbraco-CMS). These dependencies need to be updated together.


Updates `dompurify` from 3.1.7 to 3.3.1
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.1.7...3.3.1)

Updates `@umbraco-cms/backoffice` from 17.0.2 to 17.1.0
- [Release notes](https://github.com/umbraco/Umbraco-CMS/releases)
- [Commits](umbraco/Umbraco-CMS@release-17.0.2...release-17.1.0)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.3.1
  dependency-type: indirect
- dependency-name: "@umbraco-cms/backoffice"
  dependency-version: 17.1.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 9, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jan 16, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/src/Umbraco.Ai.Web.StaticAssets/Client/multi-8f1d4ca600 branch January 16, 2026 07:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant