This PR contains the following updates:

🔒 Security Advisories

This PR resolves 5 known vulnerabilities across 3 packages.

Package	Severity	Advisory	Fixed in	Summary
`liquidjs`	🟠 High	GHSA-g357-x5c3-c72p (CVE-2026-55575)	`10.27.1`	LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
`dompurify`	🟡 Moderate	GHSA-55q2-fjhq-7xh7	`3.4.13`	DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
`dompurify`	🟡 Moderate	GHSA-cmwh-pvxp-8882 (CVE-2026-65898)	`3.4.11`	DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
`dompurify`	⚪ Low	GHSA-c2j3-45gr-mqc4 (CVE-2026-66010)	`3.4.12`	DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
`sanitize-html`	🟡 Moderate	GHSA-vccv-cmxp-4j9h (CVE-2026-53606)	`2.17.5`	sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Package Updates Summary

Type	Count
📦 NPM Packages	3
Total	3

📦 npm Dependencies

3 packages will be updated

Package	Change	Age	Adoption	Passing	Confidence
liquidjs (source)	`10.27.0` -> `10.29.0`
dompurify (source)	`3.4.9` -> `3.4.13`
sanitize-html (source)	`2.17.4` -> `2.17.7`

Release Notes

harttle/liquidjs (liquidjs)

10.27.0 -> 10.29.0

`v10.29.0`

Compare Source

10.29.0 (2026-08-11)

Features

add unregisterFilter method (#946) (69b2c58)
filters: add squish filter (#943) (875513f)

Released by github-actions[bot] on 8/11/2026

`v10.28.0`

Compare Source

10.28.0 (2026-08-01)

Bug Fixes

date: %s returns Unix epoch unaffected by display timezone (#932) (39c8743), closes #931

Features

Add support of inner expressions enclosed by parentheses (#863) (afa5f54)

Released by github-actions[bot] on 8/1/2026

`v10.27.2`

Compare Source

10.27.2 (2026-07-09)

Bug Fixes

charge join/json/inspect filters by produced output size (#925) (7ab49f9)
date: zero-pad milliseconds when formatting %N fractional seconds (#929) (2634f9d)
enforce ownPropertyOnly for inherited array indices (#924) (552819a)
filters: modulo should follow divisor sign for negative operands (#922) (568bd5f)
filters: return empty for out-of-range slice begin or negative length (#928...

[View full release notes]

Released by github-actions[bot] on 7/9/2026

cure53/DOMPurify (dompurify)

3.4.9 -> 3.4.13

`3.4.13`

Compare Source

Fixed an issue with hook removal during IN_PLACE sanitization, thanks koyokr
Fixed an issue with hooks potentially bypassing the clone guard, thanks AkshayjainG
Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks AkshayjainG
Bumped several dependencies where possible

Released by cure53 on 8/3/2026

`3.4.12`

Compare Source

Fixed an issue where a hook would not get called for custom elements, thanks Rikuxx0
Hardened the handling of hooks removing elements, mkrause-bee360
Added support for a few new SVG attributes, thanks cbn-falias & Develop-KIM
Hardened the handling of declarative partial updates
Updated the documentation is several spots, README, wiki, etc.
Bumped several dependencies where possible

Released by cure53 on 7/11/2026

`3.4.11`

Compare Source

Fixed an issue with a leaky config for hooks via setConfig, thanks trace37labs
Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
Updated up the linting tool-chain and removed now-redundant lint directives
Updated the documentation is several spots, README, wiki, etc.
Bumped several dependencies where possible

Released by cure53 on 6/17/2026

apostrophecms/apostrophe (sanitize-html)

2.17.4 -> 2.17.7

Compare Source

Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis

📖 View Release Notes

🔗 View Changelog

Release Notes

Changelog

📊 Package Statistics

liquidjs: 2,290,002 weekly downloads
dompurify: 61,751,417 weekly downloads
sanitize-html: 11,683,846 weekly downloads

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Buddy 🤖