Upgrading dompurify 2 to 3

Removes the foreignObject element from the list of HTML entry-points.

DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

Adds better clobbering hardening when XML content is involved.

Adds several smaller hardening and edge-case improvements.

Fixes possible bypasses when risky tags are allow-listed.

Fixes hooks potentially bypassing the clone guard.

Fixes DOM clobbering via ownerDocument during IN_PLACE sanitization.

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Hardens the handling of hooks removing elements.

Hardens the handling of declarative partial updates.

DOMPurify: CUSTOM_ELEMENT_HANDLING bypasses afterSanitizeElements for allowed custom elements.

DOMPurify: Permanent ALLOWED_ATTR pollution via setConfig() bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

DOMPurify: Trusted Types policy survives clearConfig() and can poison later RETURN_TRUSTED_TYPE output

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

Hardens handling of Shadow Roots when using IN_PLACE.

DOMPurify: Hook mutation of data.allowedTags / data.allowedAttributes permanently pollutes DEFAULT_ALLOWED_TAGS / DEFAULT_ALLOWED_ATTR

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

Hardens checks for cross-realm IN_PLACE and Shadow DOM sanitization.

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound instanceof checks

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

Fixes a bypass caused by the new HTML element selectedcontent added in 3.4.4.

Security release for an issue introduced in 3.4.4; users should upgrade immediately.

DOMPurify XSS via selectedcontent re-clone

Adds stronger checks for cross-realm windows.

Fixes the template regexes to be more robust against ReDoS attacks.

DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

Fixes ADD_TAGS function form bypassing FORBID_TAGS.

Fixes ADD_ATTR predicates skipping URI validation.

Fixes prototype pollution via USE_PROFILES.

Fixes a possible mXSS issue via Re-Contextualization.

Fixes an issue with closing tags leading to possible mXSS.

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

Fixes a possible sanitizer bypass caused by jsdom's faulty raw-text tag parsing.

Fixes a prototype pollution issue when working with custom elements.

Fixes lenient config parsing in _isValidAttribute.

DOMPurify USE_PROFILES prototype pollution allows event handlers

DOMPurify contains a Cross-site Scripting vulnerability

DOMPurify ADD_ATTR predicate skips URI validation

DOMPurify is vulnerable to mutation-XSS via Re-Contextualization

Improves handling of potentially risky content inside CDATA elements.

Improves the regular expression for raw-text elements to cover textareas.

DOMPurify contains a Cross-site Scripting vulnerability

Adds better config hardening against prototype pollution.

Removes the script that caused the fake CVE-2025-48050 entry.

Adds a stricter check to the mXSS detection regex.

Fixes a conditional and config dependent mXSS-style bypass reported by @nsysean.

DOMPurify allows Cross-site Scripting (XSS)

Fixes two conditional sanitizer bypasses discovered by @parrot409 and @Slonser.

Updates the attribute clobbering checks to prevent future bypasses, thanks @parrot409.

Fixes a possible bypass when a rather specific custom elements config is set.

Fixes an issue with comment detection and possible bypasses under specific config settings.

Fixes an issue with the execution logic of attribute hooks to prevent bypasses.

Fixes several mXSS variations found by @kevin-mizu and @Ry0taK.

Adds better hardening against Prototype Pollution attacks, thanks @kevin-mizu.

DOMPurify allows tampering by prototype pollution

DOMpurify has a nesting-based mXSS

Fixes a mutation XSS (mXSS) variation found by @kevin-mizu.

Fixes a mutation XSS (mXSS) variation found by Adam Kues of Assetnote.

Fixes an mXSS sanitiser bypass reported by @icesfont.

Adds code to track element nesting depth.

Enforces a maximum element nesting depth of 255.

Adds coverage tests and necessary clobbering protections.

Fixes another conditional bypass caused by Processing Instructions.

Fixes two possible bypasses when sanitizing an XML document and later using it in HTML.

Adds Node 23.x to tested runtimes and removes Node 17.x.

Flags this release as deprecated and directs users to DOMPurify 3.4.5 instead.