This PR contains the following updates:
🔒 Security Advisories
This PR resolves 11 known vulnerabilities across 4 packages.
| Package | Severity | Advisory | Fixed in | Summary |
|---|---|---|---|---|
dompurify | 🔴 Critical | GHSA-cg2g-xh64-v4q7 | 3.4.17 | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes |
dompurify | 🟠 High | GHSA-mrv2-3pqr-j5jr | 3.4.17 | DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) |
dompurify | ⚪ Low | GHSA-c6gr-qvv4-5v3f | 3.4.17 | DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml |
handlebars | 🔴 Critical | GHSA-8r5x-fm3f-whwj (CVE-2026-106446) | 4.7.10 | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) |
handlebars | 🔴 Critical | GHSA-p8wg-vrv2-v86f (CVE-2026-106445) | 4.7.10 | Handlebars: JavaScript Injection via Own Property Check Bypass |
handlebars | 🟡 Moderate | GHSA-xw65-4hp5-5hc7 (CVE-2026-106444) | 4.7.10 | Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates |
markdown-it | 🟠 High | GHSA-gfr2-rv44-r23c (CVE-2026-111758) | 14.3.3 | markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) |
markdown-it | ⚪ Low | GHSA-vfgh-jcmw-g37q (CVE-2026-111766) | 14.3.3 | markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled |
sanitize-html | 🟡 Moderate | GHSA-cv27-6wvh-8x7j (CVE-2026-113661) | 2.18.0 | ApostropheCMS: Incomplete CVE-2026-53606: meta http-equiv=refresh content still ships javascript: / data: URLs |
sanitize-html | 🟡 Moderate | GHSA-x3q4-9hxx-gx8m (CVE-2026-113654) | 2.18.0 | ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render |
sanitize-html | ⚪ Low | GHSA-374f-7chj-9948 (CVE-2026-113657) | 2.18.0 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) |
Package Updates Summary
| Type | Count |
|---|---|
| 📦 NPM Packages | 4 |
| Total | 4 |
📦 npm Dependencies
4 packages will be updated
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| dompurify (source) | 3.4.16 -> 3.4.17 | ||||
| handlebars (source) | 4.7.9 -> 4.7.10 | ||||
| markdown-it (source) | 15.0.2 -> 15.0.3 | ||||
| sanitize-html (source) | 2.17.7 -> 2.18.1 |
Release Notes
cure53/DOMPurify (dompurify)
3.4.16 -> 3.4.17
3.4.17
- Fixed an issue with
IN_PLACE,SAFE_FOR_TEMPLATESand shadow roots, thanks manus-pi - Fixed
IN_PLACEhandling of nodes that hooks or custom elements tough during sanitization, thanks uttej-badwane - Fixed the SMIL
attributeNameguard in XHTML mode, thanks Koukyosyumei - Hardened several smaller edge cases (namespaces, literal-text elements,
isValidAttribute()), thanks artiphishell - Added a purify-edge test runner as a compatibility check, thanks anzal1
- Clarified the
IN_PLACEdocumentation in the README about possible risks - Updated several dependencies
Released by cure53 on 10/12/2026
handlebars-lang/handlebars.js (handlebars)
4.7.9 -> 4.7.10
v4.7.10
- security: Sanitize the source map URL when minifying -
f37c599 - security: Iterate lazily in #each and strip whitespace in linear time -
812c226 - security: Escape
<!--and<scriptin precompiled output -609d1b1GHSA-xw65-4hp5-5hc7 - security: Don't trust special properties on context data -
ceec388GHSA-p8wg-vrv2-v86f - security: Only compile partials that are template strings -
c28ee7a - security: Only dispatch known node types in the Compiler and Visitor -
7d501a5 - security: Validate AST values in the compiler instead of the parser -
703fdccGHSA-8r5x-fm3f-whwj - Clarify that --root does not restrict filesystem access -
0fcf25c - Bump minimist to ^1.2.8 -
ea8ed82 - Fix Ruby component publishing documentation -
d069c1c - Fix Composer component definition -
6714e07
Compatibility notes:
iterates iterables such asMap,Setand generators lazily, likefor...of, instead of copying them into an array first. Values added to the iterable while the block renders...
[View full release notes]
Released by jaylinski on 10/5/2026
markdown-it/markdown-it (markdown-it)
15.0.2 -> 15.0.3
Markdown-it - modern pluggable markdown parser.
apostrophecms/apostrophe (sanitize-html)
2.17.7 -> 2.18.1
Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis
📊 Package Statistics
- dompurify: 45,293,289 weekly downloads
- handlebars: 26,476,865 weekly downloads
- markdown-it: 18,103,678 weekly downloads
- sanitize-html: 7,996,719 weekly downloads
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Buddy 🤖
{"schemaVersion":1,"updates":[{"name":"dompurify","current":"3.4.16","target":"3.4.17","type":"patch","file":"packages/benchmarks/package.json","dependencyType":"dependencies"},{"name":"handlebars","current":"4.7.9","target":"4.7.10","type":"patch","file":"packages/benchmarks/package.json","dependencyType":"dependencies"},{"name":"markdown-it","current":"15.0.2","target":"15.0.3","type":"patch","file":"packages/benchmarks/package.json","dependencyType":"dependencies"},{"name":"sanitize-html","current":"2.17.7","target":"2.18.1","type":"minor","file":"packages/benchmarks/package.json","dependencyType":"dependencies"}],"group":"Security Updates","generatedAt":"2026-10-24T18:50:13.310Z"} -->