Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #47162 Bump DOMPurify to 3.2.2
    Infos
    #47162
    Thomas Gerbet (tgerbet)
    2026-03-05 19:08
    2026-03-05 15:28
    48887
    Details
    Bump DOMPurify to 3.2.2

    https://github.com/cure53/DOMPurify/releases/tag/3.3.2

    The bypass within JSDOM does not really impact Tuleap security, JSDOM is only used within the test environments.

    Regarding the prototype pollution issue it is harder to say at the moment without a full advisory.

    Dependencies
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2026-03-05
    Attachments
    Empty
    References
    Referencing request #47162

    Git commit

    tuleap/tuleap/stable

    chore: request #47162 Bump DOMPurify to 3.2.2 44346a9025
    User avatar Thomas Gerbet (tgerbet) , 2026-03-05 16:06
    Merge commit '44346a90259389e567cad74fc8b3ae98ef51353e' into HEAD master 3f94be3b25
    User avatar Clarck Robinson (robinsoc) , 2026-03-05 19:06
    chore: Force DOMPurify upgrade in the API Explorer, ignore in monaco-editor 8106847146
    User avatar Thomas Gerbet (tgerbet) , 2026-03-06 08:05
    Display settings

    Follow-ups