This PR contains the following updates:
Package Updates Summary
| Type | Count |
|---|---|
| 📦 NPM Packages | 2 |
| 🔧 System Dependencies | 1 |
| Total | 3 |
📦 npm Dependencies
2 packages will be updated
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| better-dx (source) | 0.2.5 -> 0.2.6 | ||||
| dompurify (source) | 3.3.1 -> 3.3.2 |
🔧 System Dependencies
| Package | Change | Type | File |
|---|---|---|---|
| bun.com | ^1.3.0 → ^1.3.4 | 🟢 patch | deps.yaml |
Release Notes
cure53/DOMPurify (dompurify)
3.3.1 -> 3.3.2
3.3.2
- Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
- Fixed a prototype pollution issue when working with custom elements, thanks christos-eth
- Fixed a lenient config parsing in
_isValidAttribute, thanks christos-eth - Bumped and removed several dependencies, thanks Rotzbua
- Fixed the test suite after bumping dependencies, thanks Rotzbua
Released by cure53 on 3/5/2026
📊 Package Statistics
- better-dx: 76,114 weekly downloads
- dompurify: 28,219,994 weekly downloads
- bun.com: Popular JavaScript runtime and package manager
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Buddy 🤖