[Snyk] Upgrade isomorphic-dompurify from 2.36.0 to 3.0.0#45
Open
erpranavjoshi wants to merge 1 commit intomainfrom
Open
[Snyk] Upgrade isomorphic-dompurify from 2.36.0 to 3.0.0#45erpranavjoshi wants to merge 1 commit intomainfrom
erpranavjoshi wants to merge 1 commit intomainfrom
Conversation
Snyk has created this PR to upgrade isomorphic-dompurify from 2.36.0 to 3.0.0. See this package in npm: isomorphic-dompurify See this project in Snyk: https://app.snyk.io/org/contentstack-devex/project/840d6309-d3d1-4570-a074-6709a8b30c8b?utm_source=github&utm_medium=referral&page=upgrade-pr
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade isomorphic-dompurify from 2.36.0 to 3.0.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 4 versions ahead of your current version.
The recommended version was released a month ago.
Release notes
Package name: isomorphic-dompurify
-
3.0.0 - 2026-02-21
// ESM — now works natively
import { sanitize, clearWindow } from "isomorphic-dompurify";
- Named exports are now available.
- Build output moved to
- Type definitions are auto-generated. The hand-written
- Node.js version constraint tightened. Now requires
- #368 — Memory leak and progressive slowdown in long-running Node.js processes
- #163 — ESM support
- #324 — Security concern with
- #353 —
- #350 — Build error with Astro + Cloudflare adapter
- #203 — Build error in Angular Universal
- #330, #349 —
- #356 —
- #54 —
- Source rewritten in TypeScript
- Build toolchain switched from terser to tsup (dual CJS/ESM output via esbuild)
- Linting added via Biome with lefthook pre-commit hooks and CI enforcement
- CI updated to
- Tests converted to TypeScript with expanded coverage of the wrapper API
- jsdom updated to 28.1.0
- Validated against Astro, Next.js, Nuxt, React, and SvelteKit via isomorphic-dompurify-playgrounds
-
3.0.0-rc.3 - 2026-02-17
- chore(deps): bump jsdom from 28.0.0 to 28.1.0
- chore: add Biome linting, lefthook pre-commit hooks, and CI lint step
- docs: Added Playgrounds section to the readme
-
3.0.0-rc.2 - 2026-02-07
-
3.0.0-rc.1 - 2026-02-07
-
2.36.0 - 2026-02-07
- Updated
from isomorphic-dompurify GitHub release notesisomorphic-dompurify v3.0.0
ESM Support
The library now ships proper ESM alongside CommonJS. Both
importandrequirework out of the box with correct module resolution.import DOMPurify, { sanitize } from "isomorphic-dompurify";
// CJS — still works
const DOMPurify = require("isomorphic-dompurify");
Memory Leak Fix for Long-Running Server Processes
New
clearWindow()export that closes the internal jsdom window and creates a fresh one, preventing unbounded memory growth and progressive slowdown in long-running Node.js processes (#368).// Call clearWindow() when you want to release accumulated DOM state,
// e.g. periodically, after a batch, or per-request in a server:
app.use((req, res, next) => {
res.on("finish", () => clearWindow());
next();
});
Note:
clearWindow()is a no-op in the browser build (no jsdom to manage). Any hooks or config set viaaddHook/setConfigwill need to be re-applied after calling it.Breaking Changes
sanitize,addHook,removeHook,removeHooks,removeAllHooks,setConfig,clearConfig,isValidAttribute,isSupported,version, andremovedare all exported directly.global.DOMPurifysingleton removed. The library no longer writes toglobal.DOMPurify. Module caching provides singleton behavior in both ESM and CJS. This also fixes a security concern where malicious code could preempt the global before the module loaded (#324).dist/. Entry points are nowdist/index.js(CJS),dist/index.mjs(ESM),dist/browser.js(CJS),dist/browser.mjs(ESM). Theexportsmap handles this automatically — no changes needed for consumers using standard imports.index.d.tsusingexport = DOMPurifyis replaced by generated.d.tsand.d.mtsfiles with properexport defaultand named exports.^20.19.0 || ^22.12.0 || >=24.0.0to match jsdom 28's requirements. Node 21.x, 23.x, and 22.0–22.11 are no longer supported.Issues Fixed
global.DOMPurifylru-cacheESM resolution errors in Nuxt/Nitro buildsIssues Mitigated
createWindowTypeError in Next.js 15 (jsdom is now external, reducing bundler conflicts)webidl-conversionserror in Node.js 22 + Next.jscanvasresolution error in serverless environmentsInternal Changes
actions/checkout@v4,actions/setup-node@v4,pnpm/action-setup@v4What's Changed
Full Changelog: v3.0.0-rc.2...v3.0.0-rc.3
Changelog
jsdom.See the complete changelog for more details.
Release
2.36.0
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: