[Snyk] Upgrade dompurify from 2.0.12 to 2.4.7 #2

dexterinbk · 2023-10-05T17:47:52Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade dompurify from 2.0.12 to 2.4.7.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 38 versions ahead of your current version.
The recommended version was released 3 months ago, on 2023-07-11.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Regular Expression Denial of Service (ReDoS) SNYK-JS-PRISMJS-1076581	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PRISMJS-1314893	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-PRISMJS-1585202	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-Y18N-1021887	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-PRISMJS-2404333	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	No Known Exploit
Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-1016634	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-1035544	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	No Known Exploit
Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-2863266	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-JSONPOINTER-1577287	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-JSONPOINTER-596925	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-POLISHED-1298071	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: dompurify

2.4.7 - 2023-07-11
- Fixed a licensing issue spotted and reported by @ george-thomas-hill
2.4.6 - 2023-07-10
- Fixed a bypass in jsdom 22 in case the noframes element is permitted, thanks @ leeN
2.4.5 - 2023-03-01
- Fixed a problem with improper reset of custom HTML options, thanks @ ammaraskar
2.4.4 - 2023-02-13
2.4.3 - 2023-01-06
2.4.2 - 2023-01-05
2.4.1 - 2022-11-10
2.4.0 - 2022-08-24
2.3.12 - 2022-08-23
2.3.11 - 2022-08-23
2.3.10 - 2022-07-18
2.3.9 - 2022-07-11
2.3.8 - 2022-05-13
2.3.7 - 2022-05-11
2.3.6 - 2022-02-16
2.3.5 - 2022-01-26
2.3.4 - 2021-12-07
2.3.3 - 2021-09-20
2.3.2 - 2021-09-15
2.3.1 - 2021-08-13
2.3.0 - 2021-07-06
2.2.9 - 2021-06-01
2.2.8 - 2021-04-28
2.2.7 - 2021-03-12
2.2.6 - 2020-12-18
2.2.5 - 2020-12-18
2.2.4 - 2020-12-15
2.2.3 - 2020-12-07
2.2.2 - 2020-11-02
2.2.1 - 2020-11-02
2.2.0 - 2020-10-21
2.1.1 - 2020-09-25
2.1.0 - 2020-09-23
2.0.17 - 2020-09-20
2.0.16 - 2020-09-18
2.0.15 - 2020-09-03
2.0.14 - 2020-08-27
2.0.13 - 2020-08-27
2.0.12 - 2020-06-24

from dompurify GitHub release notes

Commit messages

Package name: dompurify

ef731c0 chore: Preparing 2.4.7. release
5b7dff9 chore: Preparing 2.4.6 release
a01c083 Fix: addressed a bypass on jsdom 22 when noframes tag is allowed
f464d95 chore: preparing 2.4.5 release
fa4e8ee chore: preparing 2.4.4 release
f5c25ac see Cannot install redoc-cli globally Redocly/redoc#767
08e9fab test: Added 2.x tag to 2.x branch actions
5f766bc See Matrix parameter support Redocly/redoc#761
90326ef Merge pull request docs: fix link to OpenAPI specification in vendor extensions doc Redocly/redoc#750 from cure53/dependabot/npm_and_yarn/json5-1.0.2
fade506 chore: Prepare 2.4.3, final feature release compatible w. MSIE10/11
3afe389 build(deps): bump json5 from 1.0.1 to 1.0.2
f1e180f fix: merged from latest main
7707778 Update README.md
5267b04 chore: Preparing 2.4.2 release
d1dd037 fix: Fixed a prototype pollution bug reported by @ kevin_mizu
24d2a7f Merge pull request Clicking the menu doesn't work correctly with scrollYOffset set Redocly/redoc#748 from tosmolka/tosmolka/747
7de86a0 Fix formatting
191cc00 Fix Trusted Types Sink violation with empty input and NAMESPACE
4945074 Merge pull request example/default ignored when using ref Redocly/redoc#745 from cure53/dependabot/npm_and_yarn/qs-and-body-parser-6.11.0
7e9fcd9 build(deps): bump qs and body-parser
2734b2d Merge pull request External Documentation is not rendered if it's inside root of the schema Redocly/redoc#737 from cure53/dependabot/npm_and_yarn/engine.io-and-socket.io-6.2.1
f3b68d9 build(deps): bump engine.io and socket.io
9a751e4 Merge pull request Strange offset behaviour when redoc is in a container with a fixed height Redocly/redoc#732 from Pomierski/patch-1
2c03b6c fix