chore(deps): update dependency dompurify to v3.4.15 by thomhurst · Pull Request #6732 · thomhurst/TUnit

thomhurst · 2026-09-06T12:17:40Z

This PR contains the following updates:

Package	Type	Update	Change
dompurify	resolutions	patch	`3.4.14` → `3.4.15`

Release Notes

cure53/DOMPurify (dompurify)

`v3.4.15`: DOMPurify 3.4.15

Compare Source

Added better clobbering hardening when XML content is involved, thanks @gnyselcuk
Added several smaller hardening and edge-case improvements, thanks @leechristensen
Bumped several dependencies where possible

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

coderabbitai · 2026-09-06T12:18:51Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: a9783e69-3ba5-4496-8f12-49e8be1b195d

📥 Commits

Reviewing files that changed from the base of the PR and between e5af44a and fada23f.

⛔ Files ignored due to path filters (1)

docs/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

docs/package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

📝 Walkthrough

Walkthrough

The documentation package updates its dompurify resolution from 3.4.14 to 3.4.15.

Changes

Documentation dependency update

Layer / File(s)	Summary
Update dompurify resolution `docs/package.json`	The `dompurify` resolution changes from `3.4.14` to `3.4.15`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to fada2

Documentation builds will use dompurify 3.4.15, with the lockfile aligned to the declared resolution. No current merge-blocking risk is identified.

Poem

A rabbit checks the package tree
A safer version hops in free
The old pin rests, the new one gleams
The docs now follow fresher dreams
One small change completes the scene

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency update from dompurify 3.4.14 to 3.4.15.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/dompurify-3.x

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

greptile-apps · 2026-09-06T12:19:06Z

Greptile Summary

This PR updates the documentation site’s DOMPurify resolution from 3.4.14 to 3.4.15.

Updates the direct resolution in docs/package.json.
Refreshes the corresponding Yarn lockfile version, tarball URL, and integrity hash.
Preserves the compatible Mermaid dependency selector and DOMPurify optional dependency.

Confidence Score: 5/5

The PR appears safe to merge because the patch dependency update is internally consistent across the manifest and lockfile.

No actionable failures were identified; the resolved version satisfies the existing transitive semver constraint and the lockfile retains the dependency metadata.

Important Files Changed

Filename	Overview
docs/package.json	Updates the DOMPurify resolution from 3.4.14 to 3.4.15.
docs/yarn.lock	Consistently refreshes the coalesced DOMPurify lock entry for version 3.4.15.

_{Reviews (1): Last reviewed commit: "chore(deps): update dependency dompurify..." | Re-trigger Greptile}

Updated [Microsoft.Extensions.TimeProvider.Testing](https://github.com/dotnet/extensions) from 10.9.0 to 10.10.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Extensions.TimeProvider.Testing's releases](https://github.com/dotnet/extensions/releases)._ No release notes found for this version range. Commits viewable in [compare view](https://github.com/dotnet/extensions/commits). </details> Updated [Microsoft.NET.Test.Sdk](https://github.com/microsoft/vstest) from 18.9.0 to 18.10.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.NET.Test.Sdk's releases](https://github.com/microsoft/vstest/releases)._ ## 18.10.0 ## What's Changed * Drop Mono fallback, run .NET Framework tests on Windows only by @nohwnd in microsoft/vstest#16158 * Run Microsoft.Testing.Platform test apps under `vstest.console` and datacollector by @nohwnd in microsoft/vstest#16201 * Fix test output eaten by MSBuild terminal logger by @nohwnd in microsoft/vstest#16223 * Remove the experimental test session feature by @nohwnd in microsoft/vstest#16231 * Skip a single bad executor instead of failing all executor loading by @nohwnd in microsoft/vstest#16239 * Assert apartment state instead of using Clipboard in UI tests by @nohwnd in microsoft/vstest#16270 * Surface test host crashes during protocol negotiation by @nohwnd in microsoft/vstest#16285 * Pass the inferred target platform to the host in run settings by @nohwnd in microsoft/vstest#16271 * Report raw invalid IsTargetPlatformInferred value, cover host x64 forcing by @nohwnd in microsoft/vstest#16295 * Disable the MTP testhost by default (#16337) by @nohwnd in microsoft/vstest#16341 **Full Changelog**: microsoft/vstest@v18.9.0...v18.10.0 Commits viewable in [compare view](microsoft/vstest@v18.9.0...v18.10.0). </details> Updated [Microsoft.SourceLink.GitHub](https://github.com/dotnet/dotnet) from 10.0.400 to 10.0.401. <details> <summary>Release notes</summary> _Sourced from [Microsoft.SourceLink.GitHub's releases](https://github.com/dotnet/dotnet/releases)._ ## 10.0.401 [Release](https://github.com/dotnet/core/releases/tag/v10.0.12) ## What's Changed * [release/10.0.4xx] Source code updates from dotnet/sdk by @dotnet-maestro[bot] in dotnet/dotnet#8011 * [release/10.0.4xx] Source code updates from dotnet/sdk by @dotnet-maestro[bot] in dotnet/dotnet#8037 * [release/10.0.4xx] Source code updates from dotnet/sdk by @dotnet-maestro[bot] in dotnet/dotnet#8038 * Update Source-Build SDK Diff Tests Baselines and Exclusions by @dotnet-sb-bot in dotnet/dotnet#7754 * [release/10.0.4xx] Source code updates from dotnet/arcade by @dotnet-maestro[bot] in dotnet/dotnet#8101 * [release/10.0.4xx] Source code updates from dotnet/source-build-assets by @dotnet-maestro[bot] in dotnet/dotnet#8104 * [release/10.0.4xx] Source code updates from dotnet/msbuild by @dotnet-maestro[bot] in dotnet/dotnet#8142 * [release/10.0.4xx] Source code updates from dotnet/sdk by @dotnet-maestro[bot] in dotnet/dotnet#8132 * [release/10.0.4xx] Source code updates from dotnet/source-build-assets by @dotnet-maestro[bot] in dotnet/dotnet#8127 * [release/10.0.4xx] Source code updates from dotnet/arcade by @dotnet-maestro[bot] in dotnet/dotnet#8156 * [release/10.0.4xx] Source code updates from dotnet/roslyn by @dotnet-maestro[bot] in dotnet/dotnet#8148 * [release/10.0.4xx] Source code updates from dotnet/sdk by @dotnet-maestro[bot] in dotnet/dotnet#8176 * [release/10.0.4xx] Source code updates from dotnet/arcade by @dotnet-maestro[bot] in dotnet/dotnet#8171 * [release/10.0.4xx] Source code updates from dotnet/scenario-tests by @dotnet-maestro[bot] in dotnet/dotnet#8092 * [release/10.0.4xx] Fix IdentityModel shared-components source build by @mthalman in dotnet/dotnet#8189 * [release/10.0.4xx] Source code updates from nuget/nuget.client by @dotnet-maestro[bot] in dotnet/dotnet#8201 * [release/10.0.4xx] Allow submodule changes when reseting submodules by @github-actions[bot] in dotnet/dotnet#8223 * [release/10.0.4xx] Source code updates from dotnet/roslyn by @dotnet-maestro[bot] in dotnet/dotnet#8215 * [release/10.0.4xx] Source code updates from dotnet/arcade by @dotnet-maestro[bot] in dotnet/dotnet#8210 * [release/10.0.4xx] Cloak SignatureCycle2 binary from VMR by @mthalman in dotnet/dotnet#8226 * [release/10.0.4xx] Ignore spurious SBoM warnings by @akoeplinger in dotnet/dotnet#8165 * [release/10.0.4xx] Source code updates from dotnet/arcade by @dotnet-maestro[bot] in dotnet/dotnet#8231 * Update to the 10.0.11 August runtimes from build 324376 by @mthalman in dotnet/dotnet#8259 * Merging internal commits for release/10.0.4xx by @dotnet-bot in dotnet/dotnet#8242 * [release/10.0.4xx] Source code updates from dotnet/arcade by @dotnet-maestro[bot] in dotnet/dotnet#8278 * [release/10.0.4xx] Source code updates from dotnet/arcade by @dotnet-maestro[bot] in dotnet/dotnet#8304 * [release/10.0.4xx] Source code updates from dotnet/roslyn by @dotnet-maestro[bot] in dotnet/dotnet#8347 * [release/10.0.4xx] Remove duplicate dependency from scenario-tests by @dkurepa in dotnet/dotnet#8350 * [release/10.0.4xx] Source code updates from dotnet/sourcelink by @dotnet-maestro[bot] in dotnet/dotnet#8344 * [release/10.0.4xx] Source code updates from dotnet/templating by @dotnet-maestro[bot] in dotnet/dotnet#8354 * [release/10.0.4xx] Fix SignCheckExclusionsFile.txt to allow signed hotreload .js file by @github-actions[bot] in dotnet/dotnet#8383 * [release/10.0.4xx] Remove TSA bug filing from pipelines by @akoeplinger in dotnet/dotnet#8389 * [release/10.0.4xx] Source code updates from dotnet/arcade by @dotnet-maestro[bot] in dotnet/dotnet#8396 * [release/10.0.4xx] [release/10.0.1xx] Update binskim lastModifiedDate in PipelineAutobaseliningConfig.yml by @github-actions[bot] in dotnet/dotnet#8408 * [release/10.0.4xx] Fix SignCheckExclusionsFile.txt for .js in source-build artifacts by @github-actions[bot] in dotnet/dotnet#8405 * [release/10.0.4xx] Source code updates from dotnet/templating by @dotnet-maestro[bot] in dotnet/dotnet#8419 * [release/10.0.4xx] Source code updates from dotnet/templating by @dotnet-maestro[bot] in dotnet/dotnet#8422 * [release/10.0.4xx] Source code updates from dotnet/msbuild by @dotnet-maestro[bot] in dotnet/dotnet#8429 * [release/10.0.4xx] Source code updates from dotnet/source-build-assets by @dotnet-maestro[bot] in dotnet/dotnet#8313 * [release/10.0.4xx] Source code updates from dotnet/templating by @dotnet-maestro[bot] in dotnet/dotnet#8452 * [release/10.0.4xx] Source code updates from dotnet/source-build-assets by @dotnet-maestro[bot] in dotnet/dotnet#8453 * [release/10.0.4xx] Source code updates from dotnet/msbuild by @dotnet-maestro[bot] in dotnet/dotnet#8469 * [release/10.0.4xx] Source code updates from dotnet/fsharp by @dotnet-maestro[bot] in dotnet/dotnet#8521 * [release/10.0.4xx] Source code updates from dotnet/arcade by @dotnet-maestro[bot] in dotnet/dotnet#8574 * [release/10.0.4xx] Bump patch version to 10.0.401 by @vseanreesermsft in dotnet/dotnet#8577 ... (truncated) Commits viewable in [compare view](dotnet/dotnet@v10.0.400...v10.0.401). </details> Updated [TUnit](https://github.com/thomhurst/TUnit) from 1.65.68 to 1.66.27. <details> <summary>Release notes</summary> _Sourced from [TUnit's releases](https://github.com/thomhurst/TUnit/releases)._ ## 1.66.27  ## What's Changed ### Other Changes * fix(mocks): initialize mock state before base constructor callbacks by @thomhurst in thomhurst/TUnit#6741 ### Dependencies * chore(deps): update tunit to 1.66.16 by @thomhurst in thomhurst/TUnit#6733 * chore(deps): update dependency testcontainers.postgresql to 4.15.0 by @thomhurst in thomhurst/TUnit#6736 * chore(deps): update dependency testcontainers.redis to 4.15.0 by @thomhurst in thomhurst/TUnit#6737 * chore(deps): update dependency testcontainers.kafka to 4.15.0 by @thomhurst in thomhurst/TUnit#6735 * chore(deps): update dependency mockolate to 3.5.0 by @thomhurst in thomhurst/TUnit#6739 **Full Changelog**: thomhurst/TUnit@v1.66.16...v1.66.27 ## 1.66.16  ## What's Changed ### Other Changes * fix: isolated name is lowercase (#6727) by @koryphaee in thomhurst/TUnit#6728 * fix: preserve concurrent Assert.Multiple failures by @thomhurst in thomhurst/TUnit#6730 * fix: preserve original HTTP mock request content by @thomhurst in thomhurst/TUnit#6731 ### Dependencies * chore(deps): update tunit to 1.66.10 by @thomhurst in thomhurst/TUnit#6726 * chore(deps): update dependency dompurify to v3.4.15 by @thomhurst in thomhurst/TUnit#6732 **Full Changelog**: thomhurst/TUnit@v1.66.10...v1.66.16 ## 1.66.10  ## What's Changed ### Other Changes * fix: restore null suppression for built-in assertion methods by @thomhurst in thomhurst/TUnit#6725 ### Dependencies * chore(deps): update tunit to 1.66.8 by @thomhurst in thomhurst/TUnit#6724 **Full Changelog**: thomhurst/TUnit@v1.66.8...v1.66.10 ## 1.66.8  ## What's Changed ### Other Changes * fix(ci): make issue triage work for external reporters by @thomhurst in thomhurst/TUnit#6720 * fix(ci): run code review on pull requests from forks by @thomhurst in thomhurst/TUnit#6722 * fix: suppress nullability warnings after Should NotBeNull assertions by @mvanhorn in thomhurst/TUnit#6700 * fix: Avoid HTML report CLI option clashes by @mvanhorn in thomhurst/TUnit#6677 ### Dependencies * chore(deps): update tunit to 1.66.0 by @thomhurst in thomhurst/TUnit#6719 * chore(deps): update dependency microsoft.kiota.abstractions to 2.1.1 by @thomhurst in thomhurst/TUnit#6721 * chore(deps): update dependency awssdk.sqs to 4.0.100.12 by @thomhurst in thomhurst/TUnit#6723 **Full Changelog**: thomhurst/TUnit@v1.66.0...v1.66.8 ## 1.66.0  ## What's Changed ### Other Changes * Compile all C# documentation snippets by @thomhurst in thomhurst/TUnit#6695 * Fix `Type` assignability assertions to evaluate represented type (not `RuntimeType`) by @thomhurst with @Copilot in thomhurst/TUnit#6711 * Clarify ClassDataSource constructor requirements by @thomhurst in thomhurst/TUnit#6716 * Add programmatic HTML reporting settings by @thomhurst in thomhurst/TUnit#6699 * Fix timeout cancellation diagnostics by @thomhurst in thomhurst/TUnit#6715 ### Dependencies * chore(deps): update tunit to 1.65.68 by @thomhurst in thomhurst/TUnit#6682 * chore(deps): update dependency verify.tool to v0.9.1 by @thomhurst in thomhurst/TUnit#6683 * chore(deps): update dependency mockolate to 3.4.1 by @thomhurst in thomhurst/TUnit#6685 * chore(deps): update dependency serialize-javascript to v7.1.1 by @thomhurst in thomhurst/TUnit#6687 * chore(deps): update dependency qs to v6.16.0 by @thomhurst in thomhurst/TUnit#6691 * chore(deps): update dependency system.reactive to v7 by @thomhurst in thomhurst/TUnit#6696 * chore(deps): update dependency imposter to 0.1.10 by @thomhurst in thomhurst/TUnit#6701 * chore(deps): update dependency microsoft.kiota.abstractions to 2.1.0 by @thomhurst in thomhurst/TUnit#6704 * chore(deps): update mstest to 4.4.0 by @thomhurst in thomhurst/TUnit#6705 * chore(deps): update dependency dotnet-trace to v10 by @thomhurst in thomhurst/TUnit#6706 * chore(deps): update microsoft.testing by @thomhurst in thomhurst/TUnit#6703 * chore(deps): update microsoft.testing by @thomhurst in thomhurst/TUnit#6713 * chore(deps): bump fast-uri from 3.1.5 to 3.1.7 in /docs by @dependabot[bot] in thomhurst/TUnit#6707 **Full Changelog**: thomhurst/TUnit@v1.65.68...v1.66.0 Commits viewable in [compare view](thomhurst/TUnit@v1.65.68...v1.66.27). </details> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore(deps): update dependency dompurify to v3.4.15

fada23f

thomhurst added dependencies Pull requests that update a dependency file PATCH renovate-bot labels Sep 6, 2026

thomhurst enabled auto-merge (squash) September 6, 2026 12:17

thomhurst added PATCH renovate-bot labels Sep 6, 2026

thomhurst temporarily deployed to Pull Requests September 6, 2026 12:17 — with GitHub Actions Inactive

thomhurst merged commit daf0789 into main Sep 6, 2026
15 checks passed

thomhurst deleted the renovate/dompurify-3.x branch September 6, 2026 12:49

Navigation Menu

Uh oh!

chore(deps): update dependency dompurify to v3.4.15 - #6732

chore(deps): update dependency dompurify to v3.4.15#6732
thomhurst merged 1 commit into
mainfrom
renovate/dompurify-3.x

thomhurst commented Sep 6, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 6, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

greptile-apps Bot commented Sep 6, 2026

Important Files Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

thomhurst commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.4.15: DOMPurify 3.4.15

Configuration

Uh oh!

coderabbitai Bot commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

greptile-apps Bot commented Sep 6, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

thomhurst commented Sep 6, 2026 •

edited

Loading

`v3.4.15`: DOMPurify 3.4.15

coderabbitai Bot commented Sep 6, 2026 •

edited

Loading