Bump dompurify, jspdf and jspdf-autotable

[dependabot]

Bumps dompurify to 3.3.3 and updates ancestor dependencies dompurify, jspdf and jspdf-autotable. These dependencies need to be updated together.

Updates dompurify from 2.2.7 to 3.3.3

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.3

• Fixed an engine requirement for Node 20 which caused hiccups, thanks @​Rotzbua

DOMPurify 3.3.2

• Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
• Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
• Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
• Bumped and removed several dependencies, thanks @​Rotzbua
• Fixed the test suite after bumping dependencies, thanks @​Rotzbua

DOMPurify 3.3.1

• Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @​MariusRumpf
• Updated the ESM import syntax to be more correct, thanks @​binhpv

DOMPurify 3.3.0

• Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
• Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
• Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren

DOMPurify 3.2.7

• Added new attributes and elements to default allow-list, thanks @​elrion018
• Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
• Added better check for animated href attributes, thanks @​llamakko
• Updated and improved the bundled types, thanks @​ssi02014
• Updated several tests to better align with new browser encoding behaviors
• Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
• Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

DOMPurify 3.2.6

• Fixed several typos and removed clutter from our documentation, thanks @​Rotzbua
• Added matrix: as an allowed URI scheme, thanks @​kleinesfilmroellchen
• Added better config hardening against prototype pollution, thanks @​EffectRenan
• Added better handling of attribute removal, thanks @​michalnieruchalski-tiugo
• Added better configuration for aggressive mXSS scrubbing behavior, thanks @​BryanValverdeU
• Removed the script that caused the fake entry CVE-2025-48050

DOMPurify 3.2.5

• Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
• Added ESM type imports in source, removes patch function, thanks @​donmccurdy
• Added script to verify various TypeScript configurations, thanks @​reduckted
• Added more modern browsers to the Karma launchers list
• Added Node 23.x to tested runtimes, removed Node 17.x
• Fixed the generation of source maps, thanks @​reduckted
• Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
• Fixed a few typos in the README file

DOMPurify 3.2.4

• Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
• Added a new feature to allow specific hook removal, thanks @​davecardwell

... (truncated)

Commits

• 8bcbf73 chore: Preparing 3.3.3 release
• 5faddd6 fix: engine requirement (#1210)
• 0f91e3a Update README.md
• d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
• c3efd48 fix: moved back from jsdom 28 to jsdom 20
• 988b888 fix: moved back from jsdom 28 to jsdom 20
• 2726c74 chore: Preparing 3.3.2 release
• 6202c7e build(deps): bump @​tootallnate/once and jsdom (#1204)
• 302b51d fix: Expanded the regex ever so slightly to also cover script
• cd85175 Merge branch 'main' of github.com:cure53/DOMPurify
• Additional commits viewable in compare view

Updates jspdf from 2.5.1 to 4.2.1

Release notes

Sourced from jspdf's releases.

v4.2.1

This release fixes two security issues.

What's Changed

• Fix HTML Injection in output methods vulnerability.
• Fix PDF Object Injection via free text annotation color vulnerability.

Full Changelog: parallax/jsPDF@v4.2.0...v4.2.1

v4.2.0

This release fixes three security issues.

What's Changed

• Fix PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton children) vulnerability.
• Fix Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions vulnerability.
• Fix PDF Object Injection via Unsanitized Input in addJS Method vulnerability.
• Add "default" property to export section in package.json by @​stefan-schweiger in parallax/jsPDF#3953

New Contributors

• @​stefan-schweiger made their first contribution in parallax/jsPDF#3953

Full Changelog: parallax/jsPDF@v4.1.0...v4.2.0

v4.1.0

This release fixes several security issues.

What's Changed

• Upgrade optional dompurify dependency to 3.3.1 in parallax/jsPDF#3948
• Fix PDF Injection in AcroForm module allows Arbitrary JavaScript Execution vulnerability
• Fix Stored XMP Metadata Injection (Spoofing & Integrity Violation) vulnerability
• Fix Shared State Race Condition in addJS Method vulnerability
• Fix Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder vulnerability

Full Changelog: parallax/jsPDF@v4.0.0...v4.1.0

v4.0.0

This release fixes a critical path traversal/local file inclusion security vulnerability in the jsPDF Node.js build. File system access is now restricted by default and can be enabled by either using node's --permission flag or the new jsPDF.allowFsRead property.

There are no other breaking changes.

v3.0.4

This release includes a bunch of bugfixes. Thanks to all contributors!

What's Changed

• [Snyk] Upgrade @​babel/runtime from 7.28.3 to 7.28.4 by @​MrRio in parallax/jsPDF#3895
• fix: cell function now properly accepts align parameter by @​vishal-rathod-07 in parallax/jsPDF#3896
• Remove duplicated function "ga" from WebPDecoder.js by @​jvdp in parallax/jsPDF#3902
• Fix font state management issue #3890 by @​srikanth-s2003 in parallax/jsPDF#3891
• Fix pages property to always return current array reference ( #3898 ) by @​Opineppes in parallax/jsPDF#3899
• Fix jsPDF + Vite compatibility issue #3851 by @​tishajain25 in parallax/jsPDF#3903

... (truncated)

Commits

• 4562ce8 4.2.1
• 4155c48 Merge commit from fork
• 87a40bb Merge commit from fork
• b1607a9 Bump minimatch from 3.1.2 to 3.1.5 (#3961)
• 42ac890 Bump rollup from 2.79.2 to 2.80.0 (#3960)
• 7af912c 4.2.0
• 56b46d4 Merge commit from fork
• 2e5e156 Merge commit from fork
• 71ad2db Merge commit from fork
• 885a777 fix: upgrade @​babel/runtime from 7.28.4 to 7.28.6 (#3954)
• Additional commits viewable in compare view

Updates jspdf-autotable from 3.5.23 to 5.0.7

Release notes

Sourced from jspdf-autotable's releases.

v5.0.7

Fixed npm publishing (v5.0.5 was never published)

v5.0.5

Updated to allow jsPDF 4.0 as peer dependency.

v5.0

Summary of changes in 5.0.0-5.0.2

• Breaking: The plugin is no longer auto applied to jsPDF in none browser environments (see more below)
• The esm build file is now chosen automatically based on your packages environment (no need to use the jspdf-autotable/es path anymore)
• HookData is now exported simonbengtsson/jsPDF-AutoTable#1075

Plugin no longer applied automatically

In this release the plugin is no longer auto applied to jsPDF in none browser environments. This is a breaking change for users that for example uses this plugin in node js and call autoTable method on the jsPDF doc instance (doc.autoTable({...}).

It is now recommended to import the autoTable method and pass it the jsPDF doc instance.

import { jsPDF } from 'jspdf'
import { autoTable } from 'jspdf-autotable'
const doc = new jsPDF()
autoTable(doc, { ... })

If you want to keep calling the plugin method on the jsPDF doc instance you can also apply the plugin to it yourself using applyPlugin:

import { jsPDF } from 'jspdf'
import { applyPlugin } from 'jspdf-autotable'
// This is now required in non browser environments to use the old
// way of calling autoTable on the jspdf doc instance.
applyPlugin(jsPDF)
const doc = new jsPDF()
doc.autoTable({ ... })

v4.0.0

Mostly minor changes but bumping major version due to old deprecation removals and upgrade to jsPDF 3.0 (that removes support for internet explorer).

• Jspdf 3.0 (removes support for internet explorer)
• You can now import autoTable with a named import import { autoTable } from ‘jspdf-autotable’) . The previously exported autoTable type is now exported as autoTableInstanceType instead.
• Removed long time deprecations
  • Removed support for all old options and styles that was soft removed and deprecated in v3.0
  • Removed old ways to get information of the last autoTable drawn: doc.previousAutoTable , doc.autoTable.previous and doc.autoTableEndPosY. Now you should use doc.lastAutoTable.
  • Removed Table#pageCount field. You should now use Table#pageNumber.
  • Removed old column/body way of calling autoTable doc.autoTable(columns, body, options). You should now use autoTable(doc, options) or doc.autoTable(options).
  • Removed doc.autoTableAddPageContent. You should now use jsPDF.autoTableSetDefaults({didDrawPage: () => {}})
  • Removed doc.autoTableAddPage(). You should now use doc.addPage().

... (truncated)

Commits

• 360a0ed 5.0.7
• a826a7a Update permissions
• b4f5bfd Add permissions
• 5438c54 5.0.6
• 2add169 Upgrade libs
• dc7c985 5.0.5
• 6e1e419 Remove token from workflow
• 3e85981 5.0.4
• c8ae7d8 Fix tests
• cb74b82 Upgrade workflows
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for jspdf-autotable since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.