Pull request #1661 · stacks/stx

ℹ️ Note
This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@11ty/eleventy (source)	`^3.1.5` → `^3.1.6`	dependencies	patch
@cwcss/crosswind	`^0.1.3` → `^0.2.4`	dependencies	minor
@cwcss/crosswind	`^0.2.0` → `^0.2.4`	dependencies	patch
@iconify/json (source)	`^2.2.463` → `^2.2.482`	devDependencies	patch
@stacksjs/clapp	`^0.2.0` → `^0.2.10`	dependencies	patch
@stacksjs/ts-cloud	`^0.2.3` → `^0.2.26`	dependencies	patch
@types/bun (source)	`^1.3.11` → `^1.3.14`	devDependencies	patch
@types/vscode (source)	`^1.110.0` → `^1.120.0`	devDependencies	minor
@vscode/vsce (source)	`^3.7.2-12` → `^3.9.1`	devDependencies	minor
actions/cache	`v5.0.3` → `v5.0.5`	action	patch
actions/checkout	`v6.0.2` → `v6.0.3`	action	patch
bun (source)	`>=1.3.11` → `>=1.3.14`	peerDependencies	patch
bunfig	`^0.15.6` → `^0.15.13`	dependencies	patch
dompurify	`^3.3.3` → `^3.4.7`	dependencies	minor
ejs	`^5.0.1` → `^5.0.2`	dependencies	patch
happy-dom	`^20.8.9` → `^20.9.0`	dependencies	minor
isomorphic-dompurify	`^3.7.1` → `^3.15.0`	dependencies	minor
js-yaml	`^4.1.1` → `^4.2.0`	dependencies	minor
jsdom	`^29.0.1` → `^29.1.1`	devDependencies	minor
liquidjs	`^10.25.2` → `^10.27.0`	dependencies	minor
markdown-it	`^14.1.1` → `^14.2.0`	dependencies	minor
marked (source)	`^17.0.5` → `^17.0.6`	dependencies	patch
oven-sh/setup-bun	`v2.1.2` → `v2.2.0`	action	minor
pickier	`^0.1.20` → `^0.1.32`	devDependencies	patch
prettier (source)	`^3.8.1` → `^3.8.3`	dependencies	patch
sanitize-html (source)	`^2.17.2` → `^2.17.4`	dependencies	patch
tinybench	`^6.0.0` → `^6.0.2`	dependencies	patch
ts-broadcasting	`^0.0.4` → `^0.0.5`	dependencies	patch
typescript (source)	`^6.0.2` → `^6.0.3`	devDependencies	patch
ws	`^8.20.0` → `^8.21.0`	dependencies	minor

[!WARNING] Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

11ty/eleventy (@11ty/eleventy)

`v3.1.6`

Compare Source

cwcss/crosswind (@cwcss/crosswind)

`v0.2.4`

Compare Source

Compare changes

🚀 Features

rules: table display family, flow-root/list-item/contents, arbitrary accent/caret (f31d55c)

🧹 Chores

release v0.2.4 (09382bd)

Contributors

Chris <chrisbreuer93@>gmail.com>

`v0.2.3`

Compare Source

Compare changes

🧹 Chores

release v0.2.3 (0af1adb)
split and minify dist (23aef98)

Contributors

Chris <chrisbreuer93@>gmail.com>

`v0.2.2`

Compare Source

Compare changes

🐛 Bug Fixes

build: emit dist/index.js + dist/cli.js to match exports/bin paths (1544b47)

🧹 Chores

release v0.2.2 (a0ceda7)

Contributors

Chris <chrisbreuer93@>gmail.com>

`v0.2.1`

Compare Source

Compare changes

🚀 Features

add css alias (bcc203d)
rules: pure-CSS iconify rule for any @iconify-json/* collection (d57a427)

🐛 Bug Fixes

add setup-bun to publish-commit job (1a02e04)
resolve typecheck errors (e6caa08)

🤖 Continuous Integration

drop redundant setup-bun (pantry installs bun via deps.yaml) (b506af1)

🧹 Chores

release v0.2.1 (fb65a3d)
remove headwind refs (2290f5e)
fresh install to pick up dtsx 0.9.14 and bunfig 0.15.9 (074e1fa)
fresh install to pick up pickier 0.1.21 (c7d15c0)
cascade order improvements (126617c)
several minor improvements (04caac1)
improve arbitrary values (36d341d)
wip (38d57fd)
merge and resolve conflict (1e00cce)
fix lint errors (12526b8)
minor improvements (0a2924a)
improve group-has-* and peer-has-* (7de7dc3)
several minor improvements (cc6ffe4)

Contributors

Chris <chrisbreuer93@>gmail.com>
glennmichael123 gtorregosa@gmail.com

`v0.2.0`

Compare Source

Compare changes

🚀 Features

improve arbitrary values (9c6af1e)
handle arbitrary bracket opacity on named colors (af6f0f3)

🐛 Bug Fixes

resolve typecheck errors (8876156)
resolve typecheck errors (18bbc68)

🧹 Chores

release v0.2.0 (74a6cfa)
update lockfile (a95e37f)
release updates (c3908da)
adjust test (ce9472c)
repo cleanup and modernization (9f1d450)
repo cleanup and modernization (f5e5369)
remove unocss (4446ec1)
remove @stacksjs/docs (8ca150e)
remove redundant docs/.vitepress (9496179)
use Pantry action for publish-commit and add job dependencies (35b820a)
fix better-dx version to ^0.2.7 (4afffd7)
migrate to better-dx (2489f19)

`v0.1.6`

Compare Source

`v0.1.5`

Compare Source

Full Changelog: https://github.com/cwcss/crosswind/compare/v0.1.4...v0.1.5

iconify/icon-sets (@iconify/json)

stacksjs/clapp (@stacksjs/clapp)

`v0.2.10`

Compare Source

`v0.2.9`

Compare Source

`v0.2.8`

Compare Source

`v0.2.7`

Compare Source

`v0.2.6`

Compare Source

`v0.2.5`

Compare Source

`v0.2.4`

Compare Source

`v0.2.3`

Compare Source

stacksjs/ts-cloud (@stacksjs/ts-cloud)

`v0.2.26`

Compare Source

`v0.2.25`

Compare Source

`v0.2.24`

Compare Source

`v0.2.23`

Compare Source

`v0.2.22`

Compare Source

`v0.2.21`

Compare Source

`v0.2.20`

Compare Source

`v0.2.19`

Compare Source

`v0.2.18`

Compare Source

`v0.2.17`

Compare Source

`v0.2.16`

Compare Source

`v0.2.15`

Compare Source

`v0.2.14`

Compare Source

`v0.2.13`

Compare Source

`v0.2.12`

Compare Source

`v0.2.11`

Compare Source

`v0.2.10`

Compare Source

`v0.2.9`

Compare Source

`v0.2.8`

Compare Source

`v0.2.7`

Compare Source

`v0.2.6`

Compare Source

`v0.2.5`

Compare Source

Microsoft/vsce (@vscode/vsce)

`v3.9.1`

Compare Source

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

`v3.9.0`

Compare Source

Changes:

#1263: fix: build regressions in 3.8.1
#1261: Add override for serialize-javascript

This list of changes was auto generated.

`v3.8.1`

Compare Source

Changes:

#1259: chore: update @azure/identity to 4.13.1 and modernize TypeScript/Node.js configuration

This list of changes was auto generated.

`v3.8.0`

Compare Source

Changes:

#1258: fix: run npm audit fix
#1255: Bump brace-expansion
#1253: Bump picomatch from 2.3.1 to 2.3.2
#1252: Bump yauzl from 2.10.0 to 3.2.1
#1250: Bump underscore from 1.13.1 to 1.13.8
#1249: Bump minimatch
#1243: Bump markdown-it from 14.1.0 to 14.1.1
#1244: Bump qs from 6.14.1 to 6.14.2
#1239: Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1
#1238: Bump lodash from 4.17.21 to 4.17.23

See More

#1234: Bump qs from 6.11.0 to 6.14.1
#1233: Return non-zero exit code when signature verification fails
#1232: Audit npm package
#1228: Bump jws

This list of changes was auto generated.

`v3.7.2-13`

Compare Source

Changes:

#1258: fix: run npm audit fix

This list of changes was auto generated.

actions/cache (actions/cache)

`v5.0.5`

Compare Source

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in #1747

Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.5

`v5.0.4`

Compare Source

actions/checkout (actions/checkout)

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

oven-sh/bun (bun)

`v1.3.14`: Bun v1.3.14

Compare Source

To install Bun v1.3.14

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.14:

bun upgrade

Read Bun v1.3.14's release notes on Bun's blog

Thanks to 11 contributors!

`v1.3.13`: Bun v1.3.13

Compare Source

To install Bun v1.3.13

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.13:

bun upgrade

Read Bun v1.3.13's release notes on Bun's blog

Thanks to 8 contributors!

`v1.3.12`: Bun v1.3.12

Compare Source

To install Bun v1.3.12

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.12:

bun upgrade

Read Bun v1.3.12's release notes on Bun's blog

Thanks to 8 contributors!

stacksjs/bunfig (bunfig)

`v0.15.13`

Compare Source

`v0.15.12`

Compare Source

`v0.15.11`

Compare Source

`v0.15.10`

Compare Source

`v0.15.9`

Compare Source

`v0.15.8`

Compare Source

`v0.15.7`

Compare Source

cure53/DOMPurify (dompurify)

`v3.4.7`: DOMPurify 3.4.7

Compare Source

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker
Removed a problem leading to permanent hook pollution, thanks @offset
Refactored the test suite and expanded test coverage significantly

`v3.4.6`: DOMPurify 3.4.6

Compare Source

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde
Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde
Added more test coverage for IN_PLACE and general DOM Clobbering attacks
Bumped several dependencies where possible

`v3.4.5`

Compare Source

`v3.4.4`: DOMPurify 3.4.4

Compare Source

Added the selectedcontent element to default allow-list, thanks @lukewarlow
Added the command and commandfor attributes to default allowed-list, thanks @lukewarlow
Added better template scrubbing for IN_PLACE operations, thanks @DEMON1A
Added stronger checks for cross-realm windows, thanks @DEMON1A & @fg0x0
Updated demo website and made sure it uses the latest from main
Updated existing workflows, fuzzer, dependabot, etc., added more tests
Bumped several dependencies where possible

`v3.4.3`

Compare Source

`v3.4.2`: DOMPurify 3.4.2

Compare Source

Fixed an issue with URI validation on attributes allowed via ADD_ATTR callback, thanks @nelstrom
Fixed an issue with source maps referring to non-existing files, thanks @cmdcolin
Updated existing workflows, fuzzer, release signing, etc., added more tests
Bumped several dependencies where possible

`v3.4.1`: DOMPurify 3.4.1

Compare Source

Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
Removed a duplicate slot entry from the default HTML attribute allow-list
Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

`v3.4.0`: DOMPurify 3.4.0

Compare Source

Most relevant changes:

Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5
Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver
Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1
Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif
Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs
Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran
Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth
Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth
Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others
Fixed a problem with the type dentition patcher after Node version bump
Fixed freezing BS runs by reducing the tested browsers array
Bumped several dependencies where possible
Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

mde/ejs (ejs)

`v5.0.2`

Compare Source

Version 5.0.2

capricorn86/happy-dom (happy-dom)

`v20.9.0`

Compare Source

:art: Features

Adds support for event listener properties on Window (e.g. Window.onkeydown) - By @capricorn86 in task #2131

kkomelin/isomorphic-dompurify (isomorphic-dompurify)

`v3.15.0`: : Updated dependencies

Compare Source

dompurify 3.4.5 -> 3.4.7
@biomejs/biome 2.4.15 -> 2.4.16
vitest 4.1.6 -> 4.1.7
packageManager pnpm 11.1.3 -> 11.4.0

`v3.14.0`: : Updated dependencies

Compare Source

What's Changed

chore(deps): bump dompurify from 3.4.3 to 3.4.5 by @dependabot[bot]
chore: Allowed esbuild and disallowed lefthook for ci.
chore: Added homepage URL to package.json.

Full Changelog: https://github.com/kkomelin/isomorphic-dompurify/compare/3.13.0...3.14.0

`v3.13.0`: : Updated dependencies

Compare Source

What's Changed

chore(deps-dev): bump vitest from 4.1.5 to 4.1.6 by @dependabot[bot] in #435
chore(deps-dev): bump @types/jsdom from 28.0.1 to 28.0.3 by @dependabot[bot] in #436
chore(deps-dev): bump @biomejs/biome from 2.4.14 to 2.4.15 by @dependabot[bot] in #434
chore(deps): bump dompurify from 3.4.2 to 3.4.3 by @dependabot[bot] in #437

Full Changelog: https://github.com/kkomelin/isomorphic-dompurify/compare/3.12.0...3.13.0

`v3.12.0`: : Updated dependencies

Compare Source

What's Changed

chore(deps): bump dompurify from 3.4.1 to 3.4.2 by @dependabot[bot] in #430
chore(deps): bump jsdom from 29.1.0 to 29.1.1 by @dependabot[bot] in #431
chore(deps-dev): bump @biomejs/biome from 2.4.13 to 2.4.14 by @dependabot[bot] in #432

Full Changelog: https://github.com/kkomelin/isomorphic-dompurify/compare/3.11.0...3.12.0

Compare Source

What's Changed

chore(deps-dev): bump @biomejs/biome from 2.4.12 to 2.4.13 by @dependabot[bot] in #426
chore(deps): bump jsdom from 29.0.2 to 29.1.0 by @dependabot[bot] in #428
feat: export hook-related TypeScript types (#427) by @kkomelin in #429 (thanks @amankumarsaini28 for requesting this update)

Full Changelog: https://github.com/kkomelin/isomorphic-dompurify/compare/3.10.0...3.11.0

`v3.10.0`: : Updated dependencies

Compare Source

What's Changed

chore(deps-dev): bump lefthook from 2.1.5 to 2.1.6 by @dependabot[bot] in #422
chore(deps-dev): bump typescript from 6.0.2 to 6.0.3 by @dependabot[bot] in #423
chore(deps-dev): bump vitest from 4.1.4 to 4.1.5 by @dependabot[bot] in #425
chore(deps): bump dompurify from 3.4.0 to 3.4.1 by @dependabot[bot] in #424

Full Changelog: https://github.com/kkomelin/isomorphic-dompurify/compare/3.9.0...3.10.0

`v3.9.0`: : Updated dompur

✂ Note
PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Release Notes

🚀 Features

🧹 Chores

Contributors

🧹 Chores

Contributors

🐛 Bug Fixes

🧹 Chores

Contributors

🚀 Features

🐛 Bug Fixes

🤖 Continuous Integration

🧹 Chores

Contributors

🚀 Features

🐛 Bug Fixes

🧹 Chores

Changes:

Changes:

Changes:

Changes:

Changes:

What's Changed

v1.3.14: Bun v1.3.14

Thanks to 11 contributors!

v1.3.13: Bun v1.3.13

Thanks to 8 contributors!

v1.3.12: Bun v1.3.12

Thanks to 8 contributors!

v3.4.7: DOMPurify 3.4.7

v3.4.6: DOMPurify 3.4.6

v3.4.4: DOMPurify 3.4.4

v3.4.2: DOMPurify 3.4.2

v3.4.1: DOMPurify 3.4.1

v3.4.0: DOMPurify 3.4.0

:art: Features

v3.15.0: : Updated dependencies

v3.14.0: : Updated dependencies

What's Changed

v3.13.0: : Updated dependencies

What's Changed

v3.12.0: : Updated dependencies

What's Changed

v3.11.0: : Export hook-related TypeScript types

What's Changed

v3.10.0: : Updated dependencies

What's Changed

v3.9.0: : Updated dompur

Configuration

`v1.3.14`: Bun v1.3.14

`v1.3.13`: Bun v1.3.13

`v1.3.12`: Bun v1.3.12

`v3.4.7`: DOMPurify 3.4.7

`v3.4.6`: DOMPurify 3.4.6

`v3.4.4`: DOMPurify 3.4.4

`v3.4.2`: DOMPurify 3.4.2

`v3.4.1`: DOMPurify 3.4.1

`v3.4.0`: DOMPurify 3.4.0

`v3.15.0`: : Updated dependencies

`v3.14.0`: : Updated dependencies

`v3.13.0`: : Updated dependencies

`v3.12.0`: : Updated dependencies

`v3.11.0`: : Export hook-related TypeScript types

`v3.10.0`: : Updated dependencies

`v3.9.0`: : Updated dompur