From 12ecf3b5c9b67a36e4f15eefd3dfd91132adac5b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Apr 2026 11:32:32 +0000
Subject: [PATCH] Bump dompurify from 3.3.3 to 3.4.0 in /tgui (#22256)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.3.3 to
3.4.0.
Release notes
Sourced from dompurify's
releases.
DOMPurify 3.4.0
Most relevant changes:
- Fixed a problem with
FORBID_TAGS not winning over
ADD_TAGS, thanks @kodareef5
- Fixed several minor problems and typos regarding MathML attributes,
thanks
@DavidOliver
- Fixed
ADD_ATTR/ADD_TAGS function leaking
into subsequent array-based calls, thanks @1Jesper1
- Fixed a missing
SAFE_FOR_TEMPLATES scrub in
RETURN_DOM path, thanks @bencalif
- Fixed a prototype pollution via
CUSTOM_ELEMENT_HANDLING, thanks @trace37labs
- Fixed an issue with
ADD_TAGS function form bypassing
FORBID_TAGS, thanks @eddieran
- Fixed an issue with
ADD_ATTR predicates skipping URI
validation, thanks @christos-eth
- Fixed an issue with
USE_PROFILES prototype pollution,
thanks @christos-eth
- Fixed an issue leading to possible mXSS via Re-Contextualization,
thanks
@researchatfluidattacks
and others
- Fixed an issue with closing tags leading to possible mXSS, thanks
@frevadiscor
- Fixed a problem with the type dentition patcher after Node version
bump
- Fixed freezing BS runs by reducing the tested browsers array
- Bumped several dependencies where possible
- Added needed files for OpenSSF scorecard checks
Published Advisories are here:
https://github.com/cure53/DOMPurify/security/advisories?state=published
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/Aurorastation/Aurora.3/network/alerts).
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
tgui/packages/tgui-panel/package.json | 2 +-
tgui/packages/tgui/package.json | 2 +-
tgui/yarn.lock | 12 ++++++------
3 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/tgui/packages/tgui-panel/package.json b/tgui/packages/tgui-panel/package.json
index d442e03f202..5565fabd78a 100644
--- a/tgui/packages/tgui-panel/package.json
+++ b/tgui/packages/tgui-panel/package.json
@@ -4,7 +4,7 @@
"version": "4.3.1",
"dependencies": {
"common": "workspace:*",
- "dompurify": "^3.3.2",
+ "dompurify": "^3.4.0",
"inferno": "^7.4.8",
"tgui": "workspace:*",
"tgui-dev-server": "workspace:*",
diff --git a/tgui/packages/tgui/package.json b/tgui/packages/tgui/package.json
index d9195df46a4..23093c50310 100644
--- a/tgui/packages/tgui/package.json
+++ b/tgui/packages/tgui/package.json
@@ -7,7 +7,7 @@
"@types/marked": "^4.0.8",
"common": "workspace:*",
"dateformat": "^4.5.1",
- "dompurify": "^3.3.2",
+ "dompurify": "^3.4.0",
"es-toolkit": "^1.39.3",
"highlight.js": "^11.5.1",
"inferno": "^7.4.8",
diff --git a/tgui/yarn.lock b/tgui/yarn.lock
index 449a2786fd9..7065051e1d1 100644
--- a/tgui/yarn.lock
+++ b/tgui/yarn.lock
@@ -4024,15 +4024,15 @@ __metadata:
languageName: node
linkType: hard
-"dompurify@npm:^3.3.2":
- version: 3.3.3
- resolution: "dompurify@npm:3.3.3"
+"dompurify@npm:^3.4.0":
+ version: 3.4.0
+ resolution: "dompurify@npm:3.4.0"
dependencies:
"@types/trusted-types": ^2.0.7
dependenciesMeta:
"@types/trusted-types":
optional: true
- checksum: 2ba5b40129259836f1e6c98e99d16608d34c7f4ad6ba457ac8c932f0e2c8e0e7c27561d25fcabf97e695eec57fd5eef1c065b324a542e5125631d4f768af2736
+ checksum: 8c4286d3d379c6133ff2951d73d946974ef079f5d651d66cf90c1a6e57d8d2d304e7bc18280d27c38835200bbe03877fd93fb22f9f1fb9e086d68ffcd2d5dd16
languageName: node
linkType: hard
@@ -9251,7 +9251,7 @@ resolve@^2.0.0-next.3:
resolution: "tgui-panel@workspace:packages/tgui-panel"
dependencies:
common: "workspace:*"
- dompurify: ^3.3.2
+ dompurify: ^3.4.0
inferno: ^7.4.8
tgui: "workspace:*"
tgui-dev-server: "workspace:*"
@@ -9335,7 +9335,7 @@ resolve@^2.0.0-next.3:
"@types/marked": ^4.0.8
common: "workspace:*"
dateformat: ^4.5.1
- dompurify: ^3.3.2
+ dompurify: ^3.4.0
es-toolkit: ^1.39.3
highlight.js: ^11.5.1
inferno: ^7.4.8