Skip to content

Bump dompurify and react-admin #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 30, 2025

Bumps dompurify to 3.2.6 and updates ancestor dependency react-admin. These dependencies need to be updated together.

Updates dompurify from 2.5.6 to 3.2.6

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.6

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year

DOMPurify 3.2.3

DOMPurify 3.2.2

  • Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @​yaniv-git
  • Fixed several minor issues with the type definitions, thanks again @​reduckted
  • Fixed a minor issue with the types reference for trusted types, thanks @​reduckted
  • Fixed a minor problem with the template detection regex on some systems, thanks @​svdb99

DOMPurify 3.2.1

DOMPurify 3.2.0

DOMPurify 3.1.7

  • Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @​masatokinugawa
  • Fixed several smaller typos in documentation and test & build files, thanks @​christianhg
  • Added better support for Angular compiler, thanks @​jeroen1602
  • Added several new attributes to HTML and SVG allow-list, thanks @​Gigabyte5671 and @​Rotzbua

... (truncated)

Commits

Updates react-admin from 4.16.15 to 5.9.0

Release notes

Sourced from react-admin's releases.

5.9.0

  • Add support for customization with MUI theme to inputs (#10772) (Madeorsk)
  • Add support for customization with MUI theme to main views components and buttons (#10771) (Madeorsk)
  • Add support for customization with MUI theme to fields and delete buttons (#10770) (Madeorsk)
  • Add <RecordField> component (#10749) (fzaninotto)
  • Add support for middlewares to useUpdateMany (#10795) (slax57)
  • Allow resource specific translations for pages and buttons (#10686) (djhi)
  • Fix <AutocompleteInput> should not break when overriding input slot props (#10793) (slax57)
  • Fix bulk action buttons hover style (#10788) (djhi)
  • Fix image alignment in ready page in some contexts (#10780) (Madeorsk)
  • Fix useLogoutAccessDenied should not throw when no redirectTo is provided (#10763) (carloshv93)
  • [Doc] AuthProvider List: Add Appwrite (#10798) (slax57)
  • [Doc] DataProvider List: Update Appwrite logo and name (#10787) (slax57)
  • [Doc] Add a migration section in <DataTable> documentation that shows the codemod (#10786) (djhi)
  • [Doc] Mention that helperText also supports translation keys (#10785) (slax57)
  • [Doc] Add deployment instructions (#10783) (Madeorsk)
  • [Doc] Change our Datagrid examples to DataTable (#10766) (erwanMarmelab)
  • [Demo] Remove duplicate file segments.ts (#10792) (slax57)
  • [chore] Ensure tests are working in all environments by running them in US english (#10781) (Madeorsk)

v5.8.4

  • Add a codemod to migrate <Datagrid> to <DataTable> (#10762) (erwanMarmelab)
  • Update Guessers to use <DataTable> instead of <Datagrid> (#10754) (erwanMarmelab)
  • Update create-react-admin to show a spinner while installing dependencies (#10778) (djhi)
  • Fix <DataTable> crashes when its data is not a React primitive (#10777) (djhi)
  • Fix redirect loop when useGetOne returns an error (#10776) (jonathanarnault)
  • Fix disabled <BooleanInput> (#10773) (Madeorsk)
  • Fix <SaveButton> is not enabled when the form is prefilled (from <CloneButton> for instance) (#10765) (djhi)
  • [Demo] Fix infinite loop when loading the demo apps for the first time (#10769) (jonathanarnault)
  • [Doc] Rename convertRaMessagesToI18next to convertRaTranslationsToI18next (#10774) (Madeorsk)
  • [Doc] Fix videos in <DataTable> docs (#10775) (Madeorsk)

5.8.3

  • Fix potential prototype-polluting assignment in ra-data-local-storage (#10758) (fzaninotto)
  • [Doc] Document that optionValue only works with the choices prop (#10760) (slax57)
  • [Doc] Fix typo in <SelectInput> disabled choice example (#10753) (notz)
  • [Doc] Fix create-react-admin instructions when using yarn (#10752) (erwanMarmelab)
  • [Doc] Update <AutoPersistInStore> implementation explanation (#10751) (erwanMarmelab)
  • [Doc] Add a new third-party component huyanhvn/react-admin-clipboard-field (#10736) (huyanhvn)

5.8.2

  • Fix <AutocompleteInput> with optionValue and create raises a React warning (#10747) (slax57)
  • Fix useInfiniteListController does not return response meta (#10746) (slax57)
  • Fix create-react-admin --help does not show help consistently (#10744) (erwanMarmelab)
  • Fix compatibility of unit tests with react-hook-form 7.56.x (#10742) (slax57)
  • Fix outlined inputs when label is false (#10740) (fzaninotto)
  • Fix <SelectArrayInput> sanitizes unused props (#10739) (ghadabezine)
  • Fix <ArrayInput> multiple reset (#10716) (erwanMarmelab)
  • Fix MUI7 compatibility by not using deprecated system props (#10680) (smeng9)
  • [Doc] Fix remaining <AutocompleteArrayInput> and <SelectArrayInput> create examples (#10741) (slax57)

... (truncated)

Changelog

Sourced from react-admin's changelog.

5.9.0

  • Add support for customization with MUI theme to inputs (#10772) (Madeorsk)
  • Add support for customization with MUI theme to main views components and buttons (#10771) (Madeorsk)
  • Add support for customization with MUI theme to fields and delete buttons (#10770) (Madeorsk)
  • Add <RecordField> component (#10749) (fzaninotto)
  • Add support for middlewares to useUpdateMany (#10795) (slax57)
  • Allow resource specific translations for pages and buttons (#10686) (djhi)
  • Fix <AutocompleteInput> should not break when overriding input slot props (#10793) (slax57)
  • Fix bulk action buttons hover style (#10788) (djhi)
  • Fix image alignment in ready page in some contexts (#10780) (Madeorsk)
  • Fix useLogoutAccessDenied should not throw when no redirectTo is provided (#10763) (carloshv93)
  • [Doc] AuthProvider List: Add Appwrite (#10798) (slax57)
  • [Doc] DataProvider List: Update Appwrite logo and name (#10787) (slax57)
  • [Doc] Add a migration section in <DataTable> documentation that shows the codemod (#10786) (djhi)
  • [Doc] Mention that helperText also supports translation keys (#10785) (slax57)
  • [Doc] Add deployment instructions (#10783) (Madeorsk)
  • [Doc] Change our Datagrid examples to DataTable (#10766) (erwanMarmelab)
  • [Demo] Remove duplicate file segments.ts (#10792) (slax57)
  • [chore] Ensure tests are working in all environments by running them in US english (#10781) (Madeorsk)

5.8.4

  • Replace Datagrid by DataTable in Guessers (#10754) (erwanMarmelab)
  • Fix <DataTable> crashes when its data is not a React primitive (#10777) (djhi)
  • Fix(show/edit): Avoid a redirect loop when useGetOne returns an error in shadcn-admin-kit (#10776) (jonathanarnault)
  • Fix disabled <BooleanInput> (#10773) (Madeorsk)
  • Fix: avoid an infinite loop when loading the demo apps for the first time (#10769) (jonathanarnault)
  • Fix <SaveButton> is not enabled when the form is prefilled (from <CloneButton> for instance) (#10765) (djhi)
  • [chore] Add spinner while installing dependencies in create-react-admin (#10778) (djhi)
  • [Doc] Rename convertRaMessagesToI18next to convertRaTranslationsToI18next (#10774) (Madeorsk)
  • [Doc] Fix videos in <DataTable> docs (#10775) (Madeorsk)

5.8.3

  • Fix potential prototype-polluting assignment in ra-data-local-storage (#10758) (fzaninotto)
  • [Doc] Document that optionValue only works with the choices prop (#10760) (slax57)
  • [Doc] Fix typo in <SelectInput> disabled choice example (#10753) (notz)
  • [Doc] Fix create-react-admin instructions when using yarn (#10752) (erwanMarmelab)
  • [Doc] Update <AutoPersistInStore> implementation explanation (#10751) (erwanMarmelab)
  • [Doc] Add a new third-party component huyanhvn/react-admin-clipboard-field (#10736) (huyanhvn)

5.8.2

  • Fix <AutocompleteInput> with optionValue and create raises a React warning (#10747) (slax57)
  • Fix useInfiniteListController does not return response meta (#10746) (slax57)
  • Fix create-react-admin --help does not show help consistently (#10744) (erwanMarmelab)
  • Fix compatibility of unit tests with react-hook-form 7.56.x (#10742) (slax57)
  • Fix outlined inputs when label is false (#10740) (fzaninotto)
  • Fix <SelectArrayInput> sanitizes unused props (#10739) (ghadabezine)

... (truncated)

Upgrade guide

Sourced from react-admin's upgrade guide.


layout: default title: "Upgrading to v5"

Upgrading to v5

React-admin v5 mostly focuses on removing deprecated features and upgrading dependencies. This makes the upgrade process easier than previous versions. However, there are still some breaking changes you should be aware of.

... (truncated)

Commits
  • 67e6782 Update changelog for version 5.9.0
  • 1da2505 Update create-react-admin templates dependencies for version 5.9.0
  • 1cf4647 Update docs/OldVersion.md for version 5.9.0
  • f1ed291 v5.9.0
  • dea00a7 Merge branch 'master' into next
  • 706daf4 Merge pull request #10686 from marmelab/resource-specific-translations
  • 5a9ea03 Avoid double translation in \<UpdateWithConfirmButton>
  • 854d839 Merge pull request #10798 from marmelab/doc-appwrite-auth-provider
  • 2025a90 Merge pull request #10766 from marmelab/doc/change-datagrid-for-datatable
  • 20feab0 [Doc] AuthProvider List: Add Appwrite
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [dompurify](https://github.com/cure53/DOMPurify) to 3.2.6 and updates ancestor dependency [react-admin](https://github.com/marmelab/react-admin). These dependencies need to be updated together.


Updates `dompurify` from 2.5.6 to 3.2.6
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@2.5.6...3.2.6)

Updates `react-admin` from 4.16.15 to 5.9.0
- [Release notes](https://github.com/marmelab/react-admin/releases)
- [Changelog](https://github.com/marmelab/react-admin/blob/master/CHANGELOG.md)
- [Upgrade guide](https://github.com/marmelab/react-admin/blob/master/docs/Upgrade.md)
- [Commits](marmelab/react-admin@v4.16.15...v5.9.0)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.2.6
  dependency-type: indirect
- dependency-name: react-admin
  dependency-version: 5.9.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants