Update dependency @xmldom/xmldom to ^0.8.0 #1757

Closed
opened 2026-04-05 16:34:12 +02:00 by MrUnknownDE · 0 comments
Owner

Originally created by @renovate[bot] on 8/4/2023

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@xmldom/xmldom ^0.7.5 -> ^0.8.0 age adoption passing confidence

Release Notes

xmldom/xmldom (@​xmldom/xmldom)

v0.8.10

Compare Source

Fixed
  • dom: prevent iteration over deleted items #514/ #499

Thank you, @​qtow, for your contributions

v0.8.9

Compare Source

Fixed
  • Set nodeName property in ProcessingInstruction #509 / #505

Thank you, @​cjbarth, for your contributions

v0.8.8

Compare Source

Fixed
  • extend list of HTML entities #489

Thank you, @​zorkow, for your contributions

v0.8.7

Compare Source

Fixed
  • properly parse closing where the last attribute has no value #485 / #486

Thank you, @​bulandent, for your contributions

v0.8.6

Compare Source

Fixed
  • Properly check nodes before replacement #457 / #455 / #456

Thank you, @​edemaine, @​pedro-l9, for your contributions

v0.8.5

Compare Source

Fixed
  • fix: Restore ES5 compatibility #452 / #453

Thank you, @​fengxinming, for your contributions

v0.8.4

Compare Source

Fixed
  • Security: Prevent inserting DOM nodes when they are not well-formed CVE-2022-39353
    In case such a DOM would be created, the part that is not well-formed will be transformed into text nodes, in which xml specific characters like < and > are encoded accordingly.
    In the upcoming version 0.9.0 those text nodes will no longer be added and an error will be thrown instead.
    This change can break your code, if you relied on this behavior, e.g. multiple root elements in the past. We consider it more important to align with the specs that we want to be aligned with, considering the potential security issues that might derive from people not being aware of the difference in behavior.
    Related Spec: https://dom.spec.whatwg.org/#concept-node-ensure-pre-insertion-validity

Thank you, @​frumioj, @​cjbarth, @​markgollnick for your contributions

v0.8.3

Compare Source

Fixed
  • Avoid iterating over prototype properties #437 / #436

Thank you, @​Supraja9726 for your contributions

v0.8.2

Compare Source

Fixed
  • fix(dom): Serialize &gt; as specified (#​395) #58
Other
  • docs: Add nodeType values to public interface description #396
  • test: Add executable examples for node and typescript #317
  • fix(dom): Serialize &gt; as specified #395
  • chore: Add minimal Object.assign ponyfill #379
  • docs: Refine release documentation #378
  • chore: update various dev dependencies

Thank you @​niklasl, @​cburatto, @​SheetJSDev, @​pyrsmk for your contributions

v0.8.1

Compare Source

Fixed
  • dom: prevent iteration over deleted items #514/ #499

Thank you, @​qtow, for your contributions

v0.8.0

Compare Source

Fixed
  • Normalize all line endings according to XML specs 1.0 and 1.1
    BREAKING CHANGE: Certain combination of line break characters are normalized to a single \n before parsing takes place and will no longer be preserved.
  • XMLSerializer: Preserve whitespace character references #284 / #310
    BREAKING CHANGE: If you relied on the not spec compliant preservation of literal \t, \n or \r in attribute values.
    To preserve those you will have to create XML that instead contains the correct numerical (or hexadecimal) equivalent (e.g. &#x9;, &#xA;, &#xD;).
  • Drop deprecated exports DOMImplementation and XMLSerializer from lib/dom-parser.js #​53 / #309
    BREAKING CHANGE: Use the one provided by the main package export.
  • dom: Remove all links as part of removeChild #343 / #355
Chore
  • ci: Restore latest tested node version to 16.x #325
  • ci: Split test and lint steps into jobs #111 / #304
  • Pinned and updated devDependencies

Thank you @​marrus-sh, @​victorandree, @​mdierolf, @​tsabbay, @​fatihpense for your contributions


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

*Originally created by @renovate[bot] on 8/4/2023* [![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [@xmldom/xmldom](https://togithub.com/xmldom/xmldom) | [`^0.7.5` -> `^0.8.0`](https://renovatebot.com/diffs/npm/@xmldom%2fxmldom/0.7.13/0.8.10) | [![age](https://developer.mend.io/api/mc/badges/age/npm/@xmldom%2fxmldom/0.8.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@xmldom%2fxmldom/0.8.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@xmldom%2fxmldom/0.7.13/0.8.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@xmldom%2fxmldom/0.7.13/0.8.10?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>xmldom/xmldom (@&#8203;xmldom/xmldom)</summary> ### [`v0.8.10`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#0810) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.9...0.8.10) ##### Fixed - dom: prevent iteration over deleted items [`#514`](https://togithub.com/xmldom/xmldom/pull/514)/ [`#499`](https://togithub.com/xmldom/xmldom/issues/499) Thank you, [@&#8203;qtow](https://togithub.com/qtow), for your contributions ### [`v0.8.9`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#089) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.8...0.8.9) ##### Fixed - Set nodeName property in ProcessingInstruction [`#509`](https://togithub.com/xmldom/xmldom/pull/509) / [`#505`](https://togithub.com/xmldom/xmldom/issues/505) Thank you, [@&#8203;cjbarth](https://togithub.com/cjbarth), for your contributions ### [`v0.8.8`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#088) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.7...0.8.8) ##### Fixed - extend list of HTML entities [`#489`](https://togithub.com/xmldom/xmldom/pull/489) Thank you, [@&#8203;zorkow](https://togithub.com/zorkow), for your contributions ### [`v0.8.7`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#087) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.6...0.8.7) ##### Fixed - properly parse closing where the last attribute has no value [`#485`](https://togithub.com/xmldom/xmldom/pull/485) / [`#486`](https://togithub.com/xmldom/xmldom/issues/486) Thank you, [@&#8203;bulandent](https://togithub.com/bulandent), for your contributions ### [`v0.8.6`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#086) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.5...0.8.6) ##### Fixed - Properly check nodes before replacement [`#457`](https://togithub.com/xmldom/xmldom/pull/457) / [`#455`](https://togithub.com/xmldom/xmldom/issues/455) / [`#456`](https://togithub.com/xmldom/xmldom/issues/456) Thank you, [@&#8203;edemaine](https://togithub.com/edemaine), [@&#8203;pedro-l9](https://togithub.com/pedro-l9), for your contributions ### [`v0.8.5`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#085) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.4...0.8.5) ##### Fixed - fix: Restore ES5 compatibility [`#452`](https://togithub.com/xmldom/xmldom/pull/452) / [`#453`](https://togithub.com/xmldom/xmldom/issues/453) Thank you, [@&#8203;fengxinming](https://togithub.com/fengxinming), for your contributions ### [`v0.8.4`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#084) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.3...0.8.4) ##### Fixed - Security: Prevent inserting DOM nodes when they are not well-formed [`CVE-2022-39353`](https://togithub.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883) In case such a DOM would be created, the part that is not well-formed will be transformed into text nodes, in which xml specific characters like `<` and `>` are encoded accordingly. In the upcoming version 0.9.0 those text nodes will no longer be added and an error will be thrown instead. This change can break your code, if you relied on this behavior, e.g. multiple root elements in the past. We consider it more important to align with the specs that we want to be aligned with, considering the potential security issues that might derive from people not being aware of the difference in behavior. Related Spec: <https://dom.spec.whatwg.org/#concept-node-ensure-pre-insertion-validity> Thank you, [@&#8203;frumioj](https://togithub.com/frumioj), [@&#8203;cjbarth](https://togithub.com/cjbarth), [@&#8203;markgollnick](https://togithub.com/markgollnick) for your contributions ### [`v0.8.3`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#083) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.2...0.8.3) ##### Fixed - Avoid iterating over prototype properties [`#437`](https://togithub.com/xmldom/xmldom/pull/437) / [`#436`](https://togithub.com/xmldom/xmldom/issues/436) Thank you, [@&#8203;Supraja9726](https://togithub.com/Supraja9726) for your contributions ### [`v0.8.2`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#082) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.1...0.8.2) ##### Fixed - fix(dom): Serialize `&gt;` as specified ([#&#8203;395](https://togithub.com/xmldom/xmldom/issues/395)) [`#58`](https://togithub.com/xmldom/xmldom/issues/58) ##### Other - docs: Add `nodeType` values to public interface description [`#396`](https://togithub.com/xmldom/xmldom/pull/396) - test: Add executable examples for node and typescript [`#317`](https://togithub.com/xmldom/xmldom/pull/317) - fix(dom): Serialize `&gt;` as specified [`#395`](https://togithub.com/xmldom/xmldom/pull/395) - chore: Add minimal `Object.assign` ponyfill [`#379`](https://togithub.com/xmldom/xmldom/pull/379) - docs: Refine release documentation [`#378`](https://togithub.com/xmldom/xmldom/pull/378) - chore: update various dev dependencies Thank you [@&#8203;niklasl](https://togithub.com/niklasl), [@&#8203;cburatto](https://togithub.com/cburatto), [@&#8203;SheetJSDev](https://togithub.com/SheetJSDev), [@&#8203;pyrsmk](https://togithub.com/pyrsmk) for your contributions ### [`v0.8.1`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#0810) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.8.0...0.8.1) ##### Fixed - dom: prevent iteration over deleted items [`#514`](https://togithub.com/xmldom/xmldom/pull/514)/ [`#499`](https://togithub.com/xmldom/xmldom/issues/499) Thank you, [@&#8203;qtow](https://togithub.com/qtow), for your contributions ### [`v0.8.0`](https://togithub.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#080) [Compare Source](https://togithub.com/xmldom/xmldom/compare/0.7.13...0.8.0) ##### Fixed - Normalize all line endings according to XML specs [1.0](https://w3.org/TR/xml/#sec-line-ends) and [1.1](https://www.w3.org/TR/xml11/#sec-line-ends) \ BREAKING CHANGE: Certain combination of line break characters are normalized to a single `\n` before parsing takes place and will no longer be preserved. - [`#303`](https://togithub.com/xmldom/xmldom/issues/303) / [`#307`](https://togithub.com/xmldom/xmldom/pull/307) - [`#49`](https://togithub.com/xmldom/xmldom/issues/49), [`#97`](https://togithub.com/xmldom/xmldom/issues/97), [`#324`](https://togithub.com/xmldom/xmldom/issues/324) / [`#314`](https://togithub.com/xmldom/xmldom/pull/314) - XMLSerializer: Preserve whitespace character references [`#284`](https://togithub.com/xmldom/xmldom/issues/284) / [`#310`](https://togithub.com/xmldom/xmldom/pull/310) \ BREAKING CHANGE: If you relied on the not spec compliant preservation of literal `\t`, `\n` or `\r` in **attribute values**. To preserve those you will have to create XML that instead contains the correct numerical (or hexadecimal) equivalent (e.g. `&#x9;`, `&#xA;`, `&#xD;`). - Drop deprecated exports `DOMImplementation` and `XMLSerializer` from `lib/dom-parser.js` [#&#8203;53](https://togithub.com/xmldom/xmldom/issues/53) / [`#309`](https://togithub.com/xmldom/xmldom/pull/309) BREAKING CHANGE: Use the one provided by the main package export. - dom: Remove all links as part of `removeChild` [`#343`](https://togithub.com/xmldom/xmldom/issues/343) / [`#355`](https://togithub.com/xmldom/xmldom/pull/355) ##### Chore - ci: Restore latest tested node version to 16.x [`#325`](https://togithub.com/xmldom/xmldom/pull/325) - ci: Split test and lint steps into jobs [`#111`](https://togithub.com/xmldom/xmldom/issues/111) / [`#304`](https://togithub.com/xmldom/xmldom/pull/304) - Pinned and updated devDependencies Thank you [@&#8203;marrus-sh](https://togithub.com/marrus-sh), [@&#8203;victorandree](https://togithub.com/victorandree), [@&#8203;mdierolf](https://togithub.com/mdierolf), [@&#8203;tsabbay](https://togithub.com/tsabbay), [@&#8203;fatihpense](https://togithub.com/fatihpense) for your contributions </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/OneUptime/oneuptime). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi4yNy4xIiwidXBkYXRlZEluVmVyIjoiMzYuMjcuMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9-->
Sign in to join this conversation.
No Label
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github/oneuptime#1757