-
-
Notifications
You must be signed in to change notification settings - Fork 6.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): unpin the dompurify dependency #4677
chore(deps): unpin the dompurify dependency #4677
Conversation
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## develop #4677 +/- ##
===========================================
+ Coverage 74.90% 77.00% +2.09%
===========================================
Files 144 144
Lines 14583 14583
Branches 563 563
===========================================
+ Hits 10924 11230 +306
+ Misses 3546 3243 -303
+ Partials 113 110 -3
Flags with carried forward coverage won't be shown. Click here to find out more. |
@knsv @aloisklink do you remember if there was a reason why dompurify was pinned? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
do you remember if there was a reason why dompurify was pinned?
There's some discussion about this here, since @markrian brought up the same issue in #3735 (comment):
dompurify
was already pinned as adependency
before we switched to renovate, and has been pinned ever since it was first added, see b468065Personally, I'm happy to unpin
dompurify
as well, but there might be a reason why it was pinned (maybe security issues?), so I'd rather have it in a separate PR so it doesn't block the rest of the changes.Taken from #3735 (comment)
I'm happy for this to be unpinned, but @knsv was the one to originally pin this in b468065, so it's worth getting a review from them.
@djadmin, Thank you for the contribution! |
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [mermaid](https://github.com/mermaid-js/mermaid) | [`10.3.0` -> `10.3.1`](https://renovatebot.com/diffs/npm/mermaid/10.3.0/10.3.1) | [![age](https://developer.mend.io/api/mc/badges/age/npm/mermaid/10.3.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/mermaid/10.3.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/mermaid/10.3.0/10.3.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mermaid/10.3.0/10.3.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>mermaid-js/mermaid (mermaid)</summary> ### [`v10.3.1`](https://github.com/mermaid-js/mermaid/releases/tag/v10.3.1) [Compare Source](https://github.com/mermaid-js/mermaid/compare/v10.3.0...v10.3.1) #### What's Changed #### Bugfixes - fix style in contributors section of intro by [@​keer4n](https://github.com/keer4n) in [mermaid-js/mermaid#4670 - fix: [#​4676](https://github.com/mermaid-js/mermaid/issues/4676) redirect fix by [@​sidharthv96](https://github.com/sidharthv96) in [mermaid-js/mermaid#4693 - [#​2139](https://github.com/mermaid-js/mermaid/issues/2139) Applying user defined classes properly when calculating shape width by [@​knsv](https://github.com/knsv) in [mermaid-js/mermaid#4722 - Bug/4645 graph node containing keyword by [@​ibrahimWassouf](https://github.com/ibrahimWassouf) in [mermaid-js/mermaid#4657 - fix: Remove triple parsing of diagrams by [@​sidharthv96](https://github.com/sidharthv96) in [mermaid-js/mermaid#4697 - resolve info `HTML` and `Document` assignment by [@​Yokozuna59](https://github.com/Yokozuna59) in [mermaid-js/mermaid#4514 - fix!(deps): fix zenuml style leakage. by [@​danshuitaihejie](https://github.com/danshuitaihejie) in [mermaid-js/mermaid#4705 - Use our prettier config on the `packages/mermaid/src/config.type.ts` file by [@​aloisklink](https://github.com/aloisklink) in [mermaid-js/mermaid#4715 - create `ParserDefinition` type by [@​Yokozuna59](https://github.com/Yokozuna59) in [mermaid-js/mermaid#4719 - standardized `error` diagram by [@​Yokozuna59](https://github.com/Yokozuna59) in [mermaid-js/mermaid#4718 #### Documentation - Docs: Directives not needed in new diagrams as yaml formatter does this for all new diagrams by [@​Incognito](https://github.com/Incognito) in [mermaid-js/mermaid#4688 - Docs: add latest blog post by [@​huynhicode](https://github.com/huynhicode) in [mermaid-js/mermaid#4668 - Lychee config by [@​mmorel-35](https://github.com/mmorel-35) in [mermaid-js/mermaid#4699 - Syntax Update CONTRIBUTING.md by [@​soomrozaid](https://github.com/soomrozaid) in [mermaid-js/mermaid#4713 #### Chores - chore(deps): update all minor dependencies (minor) by [@​renovate](https://github.com/renovate) in [mermaid-js/mermaid#4682 - build(deps-dev): bump json5 from 2.2.1 to 2.2.3 by [@​dependabot](https://github.com/dependabot) in [mermaid-js/mermaid#4685 - build(deps): bump [@​braintree/sanitize-url](https://github.com/braintree/sanitize-url) from 6.0.0 to 6.0.1 by [@​dependabot](https://github.com/dependabot) in [mermaid-js/mermaid#4686 - build(deps-dev): bump vite from 4.3.3 to 4.3.9 by [@​dependabot](https://github.com/dependabot) in [mermaid-js/mermaid#4687 - chore(deps): update all patch dependencies (patch) by [@​renovate](https://github.com/renovate) in [mermaid-js/mermaid#4681 - chore: ts-ignore comment was misleading, JISON doesn't support types by [@​Incognito](https://github.com/Incognito) in [mermaid-js/mermaid#4689 - chore(deps): unpin the dompurify dependency by [@​djadmin](https://github.com/djadmin) in [mermaid-js/mermaid#4677 - build(deps-dev): bump pnpm from 8.3.1 to 8.6.8 by [@​dependabot](https://github.com/dependabot) in [mermaid-js/mermaid#4692 #### New Contributors - [@​keer4n](https://github.com/keer4n) made their first contribution in [mermaid-js/mermaid#4670 - [@​djadmin](https://github.com/djadmin) made their first contribution in [mermaid-js/mermaid#4677 - [@​danshuitaihejie](https://github.com/danshuitaihejie) made their first contribution in [mermaid-js/mermaid#4705 - [@​soomrozaid](https://github.com/soomrozaid) made their first contribution in [mermaid-js/mermaid#4713 **Full Changelog**: mermaid-js/mermaid@v10.3.0...v10.3.1 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/levaintech/contented). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi40MC4zIiwidXBkYXRlZEluVmVyIjoiMzYuNDMuMiIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
📑 Summary
Unpins the
DOMPurify
dependency. Resolves concerns at #3735Why
This is because:
The consumers of Mermaid end up with a specific version of
DOMPurify
pulled in, and to de-duplicate that they'd need to use sort of resolutions or overrides.As
DOMPurify
is a security library, it'd benefit to get regular updates and keep things secure by default.📋 Tasks
Make sure you
MERMAID_RELEASE_VERSION
is used for all new features.develop
branch