Skip to content

chore(deps): bump sanitize-html from 2.17.3 to 2.17.4#306

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/sanitize-html-2.17.4
Closed

chore(deps): bump sanitize-html from 2.17.3 to 2.17.4#306
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/sanitize-html-2.17.4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 21, 2026

Bumps sanitize-html from 2.17.3 to 2.17.4.

Changelog

Sourced from sanitize-html's changelog.

2.17.4

Changes

  • sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

  • Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 21, 2026
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 21, 2026

⚠️ No Changeset found

Latest commit: 1d80683

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coveralls
Copy link
Copy Markdown

coveralls commented May 21, 2026

Coverage Report for CI Build 26372571512

Coverage remained the same at 59.571%

Details

  • Coverage remained the same as the base build.
  • Patch coverage: No coverable lines changed in this PR.
  • No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.


Coverage Stats

Coverage Status
Relevant Lines: 720
Covered Lines: 484
Line Coverage: 67.22%
Relevant Branches: 445
Covered Branches: 210
Branch Coverage: 47.19%
Branches in Coverage %: Yes
Coverage Strength: 6.8 hits per line

💛 - Coveralls

@justlevine
Copy link
Copy Markdown
Collaborator

@dependabot rebase

Bumps [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) from 2.17.3 to 2.17.4.
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html)

---
updated-dependencies:
- dependency-name: sanitize-html
  dependency-version: 2.17.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/sanitize-html-2.17.4 branch from 1ed3af9 to 1d80683 Compare May 24, 2026 20:57
@justlevine
Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 24, 2026

Looks like sanitize-html is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this May 24, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/sanitize-html-2.17.4 branch May 24, 2026 21:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants