Skip to content

build(deps): bump sanitize-html from 1.22.1 to 2.0.0 in /backend

Hannes Heine requested to merge pr3895head into pr3895base

Created by: Tirokk

dependabot-preview[bot] Authored by dependabot-preview[bot]

Bumps sanitize-html from 1.22.1 to 2.0.0.

Changelog

Sourced from sanitize-html's changelog.

2.0.0 (2020-09-23):

  • nestingLimit option added.
  • Updates ESLint config package and fixes warnings.
  • Upgrade is-plain-object package with named export. Thanks to Bogdan Chadkin for the contribution.
  • Upgrade postcss package and drop Node 11 and Node 13 support (enforced by postcss).

Backwards compatibility breaks:

  • There is no build. You should no longer directly link to a sanitize-html file directly in the browser as it is using modern Javascript that is not fully supported by all major browsers (depending on your definition). You should now include sanitize-html in your project build for this purpose if you have one.
  • On the server side, Node.js 10 or higher is required.
  • The default allowedTags array was updated significantly. This mostly added HTML tags to be more comprehensive by default. You should review your projects and consider the allowedTags defaults if you are not already overriding them.

2.0.0-rc.2 (2020-09-09):

  • Always use existing has function rather than duplicating it.

2.0.0-rc.1 (2020-08-26):

  • Upgrade klona package. Thanks to Bogdan Chadkin for the contribution.

2.0.0-beta.2:

  • Add files to package.json to prevent publishing unnecessary files to npm #392. Thanks to styfle for the contribution.
  • Removes iframe and nl from default allowed tags. Adds most innocuous tags to the default allowedTags array.
  • Fixes a bug when using transformTags with out textFilter. Thanks to Andrzej Porebski for the help with a failing test.

2.0.0-beta:

  • Moves the index.js file to the project root and removes all build steps within the package. Going forward, it is up to the developer to include sanitize-html in their project builds as-needed. This removes major points of conflict with project code and frees this module to not worry about myriad build-related questions.
  • Replaces lodash with utility packages: klona, is-plain-object, deepmerge, escape-string-regexp.
  • Makes custom tag transformations less error-prone by escaping frame innerText. Thanks to Mike Samuel for the contribution. Prior to this patch, tag transformations which turned an attribute value into a text node could be vulnerable to code execution.
  • Updates code to use modern features including const/let variable assignment.
  • ESLint clean up.
  • Updates is-plain-object to the 4.x major version.
  • Updates srcset to the 3.x major version.

Thanks to Bogdan Chadkin for contributions to this major version update.

1.27.5 (2020-09-23):

  • Updates README to include ES modules syntax.

1.27.4 (2020-08-26):

  • Fixes an IE11 regression from using Array.prototype.includes, replacing it with Array.prototype.indexOf.

1.27.3 (2020-08-12):

  • Fixes a bug when using transformTags with out textFilter. Thanks to Andrzej Porebski for the help with a failing test.

1.27.2 (2020-07-29):

  • Fixes CHANGELOG links. Thanks to Alex Mayer for the contribution.
  • Replaces srcset with parse-srcset. Thanks to Massimiliano Mirra for the contribution.

1.27.1 (2020-07-15):

  • Removes the unused chalk dependency.
  • Adds configuration for a Github stale bot.
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Merge request reports