Update dompurify 2.3.8 → 2.4.6 (minor)

[depfu]

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ dompurify (2.3.8 → 2.4.6) · Repo

Release Notes

2.4.6

• Fixed a bypass in jsdom 22 in case the noframes element is permitted, thanks @leeN

2.4.4

• Added support for ALLOW_SELF_CLOSE_IN_ATTR flag, thanks @edg2s @AndreVirtimo
• Added better support for shadowrootmode, thanks @mfreed7

2.4.3

• Final release that is compatible with MSIE10 & MSIE 11

2.4.2

• Fixed a Trusted Types sink violation with empty input and NAMESPACE , thanks @tosmolka
• Fixed a Prototype Pollution issue discovered and reported by @kevin-mizu

2.4.1

• Added new config option ALLOWED_NAMESPACES for better XML handling, thanks @kevin-deyoungster @tosmolka
• Added better detection of template literals when SAFE_FOR_TEMPLATES is true
• Fixed an exception caused by DOM clobbering, thanks @masatokinugawa
• Bumped some dependencies, thanks @marcpenya-tf

2.4.0

• Removed bundled types again as they caused too much trouble

2.3.12

• Fixed an issue in 2.3.11 causing errors w. TypeScript, see #712, thanks @Mirco469, @brentkeller, @aryanisml

2.3.11

• Added generated type definitions for better compatibility
• Added SANITIZE_NAMED_PROPS config option, thanks @SoheilKhodayari
• Updated README and config documentation, thanks @0xedward
• Updated test suite with newer Node versions

2.3.10

• Added support for sanitization of attributes requiring Trusted Types, thanks @tosmolka

2.3.9

• Made TAG and ATTR config options case-sensitive when parsing XHTML, thanks @tosmolka
• Bumped some dependencies, thanks @is2ei
• Included github-actions in the dependabot config, thanks @nathannaveen

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

---

This change is 

[depfu]

Closed in favor of #2614.