Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Bump dompurify from 3.3.1 to 3.4.0 in /app/bibleview-js#3753

Open
dependabot[bot] wants to merge 1 commit into
current-stableAndBible/and-bible:current-stablefrom
dependabot/npm_and_yarn/app/bibleview-js/dompurify-3.4.0AndBible/and-bible:dependabot/npm_and_yarn/app/bibleview-js/dompurify-3.4.0Copy head branch name to clipboard
Open

Bump dompurify from 3.3.1 to 3.4.0 in /app/bibleview-js#3753
dependabot[bot] wants to merge 1 commit into
current-stableAndBible/and-bible:current-stablefrom
dependabot/npm_and_yarn/app/bibleview-js/dompurify-3.4.0AndBible/and-bible:dependabot/npm_and_yarn/app/bibleview-js/dompurify-3.4.0Copy head branch name to clipboard

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 16, 2026

Copy link
Copy Markdown
Contributor

Bumps dompurify from 3.3.1 to 3.4.0.

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

  • Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
  • Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
  • Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
  • Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
  • Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
  • Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
  • Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth
  • Fixed an issue with USE_PROFILES prototype pollution, thanks @​christos-eth
  • Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @​researchatfluidattacks and others
  • Fixed an issue with closing tags leading to possible mXSS, thanks @​frevadiscor
  • Fixed a problem with the type dentition patcher after Node version bump
  • Fixed freezing BS runs by reducing the tested browsers array
  • Bumped several dependencies where possible
  • Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

DOMPurify 3.3.3

  • Fixed an engine requirement for Node 20 which caused hiccups, thanks @​Rotzbua

DOMPurify 3.3.2

  • Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
  • Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
  • Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
  • Bumped and removed several dependencies, thanks @​Rotzbua
  • Fixed the test suite after bumping dependencies, thanks @​Rotzbua
Commits
  • 5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
  • 8bcbf73 chore: Preparing 3.3.3 release
  • 5faddd6 fix: engine requirement (#1210)
  • 0f91e3a Update README.md
  • d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
  • c3efd48 fix: moved back from jsdom 28 to jsdom 20
  • 988b888 fix: moved back from jsdom 28 to jsdom 20
  • 2726c74 chore: Preparing 3.3.2 release
  • 6202c7e build(deps): bump @​tootallnate/once and jsdom (#1204)
  • 302b51d fix: Expanded the regex ever so slightly to also cover script
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump dompurify from 3.3.1 to 3.4.0 in /app/bibleview-js
c6abf37 
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.3.1 to 3.4.0.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.1...3.4.0)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 16, 2026
@dependabot dependabot Bot mentioned this pull request Apr 16, 2026
Closed
@tuomas2

tuomas2 commented Apr 16, 2026

Copy link
Copy Markdown
Contributor

Welcome and thank you for your contribution!

This project uses GitHub Copilot as a first-pass automated reviewer. Here is how the review process works:

  1. Copilot reviews your PR first. It has been automatically requested as a reviewer.
  2. Address Copilot's feedback by either pushing fixes or replying to the comment explaining why you disagree.
  3. Human review follows once all Copilot feedback is addressed — meaning Copilot found no issues, or you have responded to every comment thread.

If you used AI tools to write code, please make sure you have personally reviewed and understood every change before submitting. See CONTRIBUTING.md for details.

@tuomas2
tuomas2 requested a review from Copilot April 16, 2026 03:13
Copilot AI reviewed Apr 16, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the app/bibleview-js frontend’s HTML sanitization dependency (dompurify) to the latest 3.4.x release, incorporating upstream security and correctness fixes while keeping the project’s existing semver range conventions.

Changes:

  • Bump dompurify from ~3.3.1 to ~3.4.0 in package.json.
  • Refresh package-lock.json to lock dompurify@3.4.0 and reflect the current dependency specifiers.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
app/bibleview-js/package.json Updates the direct dependency version for dompurify to ~3.4.0.
app/bibleview-js/package-lock.json Updates the resolved/locked dompurify tarball/version and reflects the updated root dependency ranges.
Files not reviewed (1)
  • app/bibleview-js/package-lock.json: Language not supported

@tuomas2 tuomas2 added the copilot-approved Copilot review passed or all comments addressed label Apr 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

copilot-approved Copilot review passed or all comments addressed dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

Tuomas' project board
Status: Needs triage

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tuomas2
Morty Proxy This is a proxified and sanitized view of the page, visit original site.