web: bump DOMPurify to 3.4.16 (GHSA-p98j-92pf-mc4p)

jcoffey-dev commented

2026-10-09 07:27:21 +00:00

Owner

GitHub Dependabot flagged DOMPurify 3.4.15 (low, GHSA-p98j-92pf-mc4p): with IN_PLACE sanitizing and a node-removing afterSanitize hook, event handlers on a detached subtree stay armed. The message sanitizer (web/src/lib/text/html.ts) uses neither, only an afterSanitizeAttributes hook, so it isn't believed affected; this takes the patch release anyway. inbuxa Webmail and ihasmail share the sanitizer, so both get the same bump.

Change: web/package.json ^3.4.15 -> ^3.4.16 plus the lockfile.

Checked locally: npm ci, typecheck, test suite, build.

GitHub Dependabot flagged DOMPurify 3.4.15 (low, GHSA-p98j-92pf-mc4p): with IN_PLACE sanitizing and a node-removing afterSanitize hook, event handlers on a detached subtree stay armed. The message sanitizer (web/src/lib/text/html.ts) uses neither, only an afterSanitizeAttributes hook, so it isn't believed affected; this takes the patch release anyway. inbuxa Webmail and ihasmail share the sanitizer, so both get the same bump. Change: web/package.json ^3.4.15 -> ^3.4.16 plus the lockfile. Checked locally: npm ci, typecheck, test suite, build.

jcoffey-dev added 1 commit 2026-10-09 07:27:21 +00:00

web: bump DOMPurify to 3.4.16 (GHSA-p98j-92pf-mc4p)

ci / node (pull_request) Skipped

Details

ci / version (pull_request) Skipped

Details

ci / docker-build (pull_request) Skipped

Details

ci / publish (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 2m51s

Details

6303d653aa

DOMPurify 3.4.13-3.4.15 can leave event handlers armed on a detached subtree
when IN_PLACE sanitizing is combined with a node-removing afterSanitize hook
(GHSA-p98j-92pf-mc4p, low). The message sanitizer uses neither (only an
afterSanitizeAttributes hook), so it isn't believed affected, but the fix is
a patch release. Typecheck, tests and build pass.

jcoffey-dev merged commit 7694c76e64 into main

2026-10-09 07:30:42 +00:00

jcoffey-dev deleted branch deps/dompurify-3.4.16

2026-10-09 07:30:42 +00:00

web: bump DOMPurify to 3.4.16 (GHSA-p98j-92pf-mc4p) #44