[Snyk] Upgrade dompurify from 2.2.2 to 2.2.7 #4

snyk-bot · 2021-04-02T23:47:28Z

Snyk has created this PR to upgrade dompurify from 2.2.2 to 2.2.7.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 5 versions ahead of your current version.
The recommended version was released 21 days ago, on 2021-03-12.

Release notes

Package name: dompurify

2.2.7 - 2021-03-12
- Fixed handling of unsupported browsers, i.e. Safari 9 and older
- Fixed various minor bugs and typos in README and examples
- Added better handling of potentially harmful "is" attributes
- Added better handling of lookupGetter functionality
2.2.6 - 2020-12-18
- Added new mXSS prevention logic created by SecurityMB
2.2.5 - 2020-12-18
2.2.4 - 2020-12-15
- Fixed a new MathML-based bypass submitted by PewGrand
- Fixed a new SVG-related bypass submitted by SecurityMB
- Updated NodeJS CI to Node 14.x and Node 15.x
- Cleaned up _forceRemove logic for better reliability
2.2.3 - 2020-12-07
- Fixed an mXSS issue reported by PewGrand
- Fixed a minor issue with the license header
- Fixed a problem with overly-eager CSS stripping
- Updated the README and removed an XSS warning
2.2.2 - 2020-11-02
- Fixed an mXSS bypass dropped on us publicly via #482
- Fixed an mXSS variation that was reported privately short after
- Added dialog to permitted elements list
- Fixed a small typo in the README

from dompurify GitHub release notes

Commit messages

Package name: dompurify

a9ad5be chore: added correct version tags for 2.2.7
aedf30c chore: preparing 2.2.7 release
5b3225e Merge pull request Always scroll to clicked sidebar content docsifyjs/docsify#522 from cure53/dependabot/npm_and_yarn/elliptic-6.5.4
aeacb6d chore(deps): bump elliptic from 6.5.3 to 6.5.4
a16346c Added better isSupported handling for Safari 9, see Render H1 elements added via autoHeader as anchors docsifyjs/docsify#516
9efbbcc Merge pull request IE10 - Plugins are not triggered docsifyjs/docsify#514 from IT-premium-team/bugfix/lookup-getter-fallback
6fed510 clear code
76c87d5 lookupGetter: notify about fallback value
736b8e6 add fallback for lookup-getter util
62e7d48 Merge pull request 带id的链接进入，节点无法展开 docsifyjs/docsify#509 from virajkulkarni14/patch-1
b7ea6a1 Updated README as discussed in issue 希望提供灵活自定义封面内容的能力 docsifyjs/docsify#507
36bf02f Merge pull request Mermaid graphs on multiple pages only render on first synchronous load docsifyjs/docsify#504 from cure53/dependabot/npm_and_yarn/socket.io-2.4.1
4d40204 chore(deps): bump socket.io from 2.3.0 to 2.4.1
98e1ee4 Merge pull request 能否实现点击编辑按钮就打开本地文件的功能？ docsifyjs/docsify#503 from PatrickSachs/main
fa9eae2 Fixed playground syntax error
1c38b7d docs: Updated README to add credit
79d57d6 fix: Added better removal of "is" attributes, thanks @ avr4mit
c304bf6 chore: rebuilt dist version
a3f5ea9 docs: fixed a typo on README
3fffaa9 fix: removed unneeded Object.create exposure
aa612d0 fix: Added better handling of unwanted is-attributes, thanks @ CmdEngineer
61cece4 test: Fixed a test for MSIE/older Edge
03f8597 test: Added recent bypasses to test-suite
b11cb72 chore: Preparing 2.2.6 release after failed 2.2.5 attempt /2