Skip to content

Bump sanitize-html from 1.22.1 to 2.2.0 in /backend

Hannes Heine requested to merge dependabot/npm_and_yarn/backend/sanitize-html-2.2.0 into master

Created by: dependabot-preview[bot]

Bumps sanitize-html from 1.22.1 to 2.2.0.

Changelog

Sourced from sanitize-html's changelog.

2.2.0 (2020-12-02):

  • Adds a note to the README about Typescript support (or the lack-thereof).
  • Adds tel to the default allowedSchemes. Thanks to Arne Herbots for this contribution.

2.1.2 (2020-11-04):

  • Fixes typos and inconsistencies in the README. Thanks to Eric Lefevre-Ardant for this contribution.

2.1.1 (2020-10-21):

  • Fixes a bug when using allowedClasses with an '*' wildcard selector. Thanks to Clemens Damke for this contribution.
  • Updates mocha to 7.x to resolve security warnings.

2.1.0 (2020-10-07):

  • sup added to the default allowed tags list. Thanks to Julian Lam for the contribution.
  • Updates default allowedTags README documentation. Thanks to Marco Arduini for the contribution.

2.0.0 (2020-09-23):

  • nestingLimit option added.
  • Updates ESLint config package and fixes warnings.
  • Upgrade is-plain-object package with named export. Thanks to Bogdan Chadkin for the contribution.
  • Upgrade postcss package and drop Node 11 and Node 13 support (enforced by postcss).

Backwards compatibility breaks:

  • There is no build. You should no longer directly link to a sanitize-html file directly in the browser as it is using modern Javascript that is not fully supported by all major browsers (depending on your definition). You should now include sanitize-html in your project build for this purpose if you have one.
  • On the server side, Node.js 10 or higher is required.
  • The default allowedTags array was updated significantly. This mostly added HTML tags to be more comprehensive by default. You should review your projects and consider the allowedTags defaults if you are not already overriding them.

2.0.0-rc.2 (2020-09-09):

  • Always use existing has function rather than duplicating it.

2.0.0-rc.1 (2020-08-26):

  • Upgrade klona package. Thanks to Bogdan Chadkin for the contribution.

2.0.0-beta.2:

  • Add files to package.json to prevent publishing unnecessary files to npm #392. Thanks to styfle for the contribution.
  • Removes iframe and nl from default allowed tags. Adds most innocuous tags to the default allowedTags array.
  • Fixes a bug when using transformTags with out textFilter. Thanks to Andrzej Porebski for the help with a failing test.

2.0.0-beta:

  • Moves the index.js file to the project root and removes all build steps within the package. Going forward, it is up to the developer to include sanitize-html in their project builds as-needed. This removes major points of conflict with project code and frees this module to not worry about myriad build-related questions.
  • Replaces lodash with utility packages: klona, is-plain-object, deepmerge, escape-string-regexp.
  • Makes custom tag transformations less error-prone by escaping frame innerText. Thanks to Mike Samuel for the contribution. Prior to this patch, tag transformations which turned an attribute value into a text node could be vulnerable to code execution.
  • Updates code to use modern features including const/let variable assignment.
  • ESLint clean up.
  • Updates is-plain-object to the 4.x major version.
  • Updates srcset to the 3.x major version.

Thanks to Bogdan Chadkin for contributions to this major version update.

1.27.5 (2020-09-23):

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Merge request reports