Skip to content

Update dependency dompurify to v3.4.10#28623

Open
tryghost-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dompurify-3.x
Open

Update dependency dompurify to v3.4.10#28623
tryghost-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dompurify-3.x

Conversation

@tryghost-renovate

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
dompurify 3.4.93.4.10 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

cure53/DOMPurify (dompurify)

v3.4.10: DOMPurify 3.4.10

Compare Source

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
  • Decomposed the three largest sanitizer functions into focused helpers
  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
  • Reduced CI cost by running the full three-engine browser suite once per PR
  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
  • Documented the bench and test:happydom scripts in the README
  • Completed the Attack Classes & Bypass History wiki page
  • Bumped several dependencies where possible

Configuration

📅 Schedule: (in timezone Etc/UTC)

  • Branch creation
    • Only on Sunday and Saturday (* * * * 0,6)
    • Between 11:00 PM and 11:59 PM, Monday through Friday (* 23 * * 1-5)
    • Between 12:00 AM and 04:59 AM, Monday through Saturday (* 0-4 * * 1-6)
  • Automerge
    • Only on Sunday and Saturday (* * * * 0,6)
    • Between 11:00 PM and 11:59 PM, Monday through Friday (* 23 * * 1-5)
    • Between 12:00 AM and 04:59 AM, Monday through Saturday (* 0-4 * * 1-6)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@tryghost-renovate

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

<--- Last few GCs --->

[2499:0x17f03000]    28487 ms: Mark-Compact (reduce) 1023.9 (1038.9) -> 1023.9 (1037.7) MB, pooled: 0 MB, 297.71 / 0.00 ms  (+ 0.6 ms in 0 steps since start of marking, biggest step 0.0 ms, walltime since start of marking 306 ms) (average mu = 0.064, curr

<--- JS stacktrace --->

FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xe46bbe node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.3/bin/node]
 2: 0x1243640 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.3/bin/node]
 3: 0x1243917 v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/22.22.3/bin/node]
 4: 0x1472825  [/opt/containerbase/tools/node/22.22.3/bin/node]
 5: 0x1472853  [/opt/containerbase/tools/node/22.22.3/bin/node]
 6: 0x148b92a  [/opt/containerbase/tools/node/22.22.3/bin/node]
 7: 0x148eaf8  [/opt/containerbase/tools/node/22.22.3/bin/node]
 8: 0x1cf7681  [/opt/containerbase/tools/node/22.22.3/bin/node]
/usr/local/bin/node: line 18:  2499 Aborted                 (core dumped) /opt/containerbase/tools/node/22.22.3/bin/node "$@"

@github-actions github-actions Bot added the dependencies Pull requests that update a dependency file label Jun 16, 2026
@tryghost-renovate tryghost-renovate Bot force-pushed the renovate/dompurify-3.x branch from bf7b403 to a6cff3d Compare June 16, 2026 01:41
@9larsons 9larsons enabled auto-merge (squash) June 16, 2026 15:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants